last executing test programs: 35m9.542200339s ago: executing program 2 (id=56): ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={'syzkaller1\x00', {0x2, 0x4e20, @private=0xa010102}}) (async) r0 = syz_clone(0x201000, &(0x7f0000000080)="839f8975b58e96edebd86782cc85b6400f8df008bc9c9d1c0df13b801953709d5991e5233934f220ad3b89cdc42bbca81c8983f119c85e2355f5de944eef636fb50150fd3e086a1b0fe6e607dccdd8711b2af7cde08cbf4d7dcefd831cc6d6c8abefaaf1ee43017db942b6d1c2d2a2f9", 0x70, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="2d73e7f2af2cd1d5f898ff354e09ab7ff3f15fcdb2c2570816aab3e5884faadc4422334556da0f35daf2d8dfc507ea4f0718d408bc55404bef6eccd47d0c") (async, rerun: 32) r1 = fcntl$getown(0xffffffffffffffff, 0x9) (async, rerun: 32) read$FUSE(0xffffffffffffffff, &(0x7f00000001c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000003b00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000003ac0)={&(0x7f0000002200)={0x18b0, 0x25, 0x400, 0x70bd2a, 0x25dfdbff, {0x13}, [@generic="5c01c50bc67318f4afa2c3f7ab3ea302a0bb9e5b8b9f6824a5bd01378e52b7b5af09fe5dec4cea42a8966acbfd73e638dcc5e0248a13f1b59cef372d8e9ae9c4c1939c6edccf2c1e82d5f39f8bfb28bf00cd51b3903c338ed1db835d566d151eb855eb38cc0d545fce40138b373334fdc2a151fa855bc495562724e938db4189421bb80c3ddc0b53ae4921e88bb91a6404546671cc654e95ef94f4cf88a95b338ed484e873faa6201071797f68b885ee845d99518f3931c30b86aa103757d34238b789d4a5db7250c228002a5088794a8a1aa6ae4dea8a609fe34fef6dd3e062ab435c7f6e33db295ce6b98759d34a27aaf881e4784966416ccae67c5ed15a728b11d13f25b0f18a88e8a6453696a7e509b074f66080f4b874c71549e3e4bfa886b89ffcf483db5ddce9e6ec268f26de455bfc1df01a3f56ddf097d6a3a6a9b2df6d4395175970fae7c313de2c608b5cc6921f0bbfb74f0147851d99d931d2e1402e11847acb2186da829ab70e923a19bba22f74d53dfcd97fa47e10a931666eb5eed6b6bc55a0d3b8298517155bea53009271827ec803c3e3d01a4cc3ff3de0af991480cac26ea18ff541af40e471fb861256b571316f986f5f6909ead608fde407f29958bc783dd8feadbfa50a16fe57be2e399e2540525da829a3d0e0246e9c7544b0215ace66c37fab91e707cb331ff0972206d6dcaf72cfae920f0f34638853f8e1432622f5692957ec7bd49ed0f28a30ed2a5d589e38d63016e2d3b8a006328b087d2d8ccf300e5db16cae3e8b16a3baa2af152191e9efe1ac20ad34a765886d5edd6be2bfa0ffdb44cfceb3c45f38584b18db4865d37ab359a2fa7ce85e8c9ee67fd7acffa30a7cc8d87c34739cdf8a9c23e3efc743dbba280ac647e922b9ff1cc1bf80a56fe9707b838f694234961360c9ad0a3dc3ef5714b1fe20abe69c004e52aae78599d76fa548ecbe3dad004da5bcfe513f7c1253971d55022951724a22c2c6913dd982eaa03c1fd3ca9f350278f51c51ce65fce8e59ae693591a0fca6b15a978ef9b7e91b55deb4529c303e7111570efbefab74f333b423a5a08a4d90a1cacf6ec20eb4e164a94feb9c122a5881a75ea2e7b14398e444f16d6887b5fd6c89cad1bc63801809f5c1e43baade0d8f3088e2cb380fdca854c10eace722329d58a3f7d77a2773b806ad5dea0e76ce5a744ad4f8a867b3a1629413fd530777dfb0966d14d79c0eaef49e08698d282fe66748f20c6b95460ad9824ba2b3bdb7e20ff40ccb02ac8e0b830a48d451fd7f03600165d9507c014222d4249b0772c2aba3aa8f200d6cd83743d5be63d05a7c005a1ac2f0bb67149d71bcdff6cbe85c770de842cc216ca6229586ebecc81e61f60bf9f10e2579293d2a28e88b975ebbfcd95f00af8ea13fd40853993ec8c914934196d5cbfb6cb54b49acbf4c3d884b1d484117fb43c678f18ac3ec16c5e5a4b3b8c45654b8af539ed5292e2c1b3bcfd4493b3c22c28d3de985b4e6d94b6b4fefb09ef0ac3f0dcd261c4cabab9ff5d0232c26f52ab5e12e4d1517f30db669429ffb239b24c2635864ab5cd5d3299c8b00cca391678e173f70eb4f933ca061da1da54a89ea87e8fa3bda8e9e6b823db002cf244c02e236ac00eec243b5ee6de8b94419029bb92d6e88decd70a15b37db55b19c0b65c714b8fe2d5f1a18108c34406039f7b6db42f707ef125b973dceb2798b2a15039877f4ac50b8e69def75ba9ab60a5c8077c3fd42871429178cb9da8dfe0640ff953d316223ce5c21fccd6b56dd7d2b3f950ffc5fb6130202feddae3f41b9f07342f5c134073d879f5107d40b025c48e9107d385e51bd58f33b7811d11ccca1fe8352b3159c11d3118c42bb11a966218bf150e6ec52cb4687d5f21caa774f88b8954a539bda6ed8ebea01073722280690afb924d270cab88d5b470b1d6f69e5a9d9b3d801b496e8f7fd721e226f6f9b42bb270b846258a81ae29dce63e886f6ed6a9fe2fffdceba49499fcce08bb1ef7412cedf00c1fd6f3ad810fb316d4be08cc33cd575262cb78f1819924f909694a3cd8ab61b82414c7d1f985bf4d6cd4edf52e9e1fb95e78be8cf5db529b28d267098ee72de2eac6baa4ba767ba8eb2c56f2d05cf804cdfe87b050bcd4a9f53dfa16b967f5446485953a4bf790f015cad389c7d4740257476e26d7ade085a04aaabda678332e0d7245387ad8ee1f355186a55c69fddd54d9a2111ad7e1dcb0dcad767bc9fdd4e749d6a70483f9470aa05a03d2124ff3ffbfa0f40fa855e415d1b74154a95ad3899bb1664252e4f883a135a6718aaafa65cd18e62fffac3e1c5beae492d52ad2ad2b30423bd56675d9b925ddfe91091395931f386327d7ef2d92325fb37b60f3ca97a4a3f19b2e90780dca565311bf418c50b15942ab0f664f860b2f02b9180c20bffe11b932a5ef3220e12cafd0ba16b257dfcdef9b6013f50a7c6b85d15cc7a34430e167f60744dfe8018b744ef619062524a083450abc3915e7e8c9b8e9e5dcd7133b2d0518ed6aab9a6c62494acb3606079efd8ffd948f913787b93752652711bb4a12fe459226f184323df03d3fbc77503c9323834ec5fd5903e430926e1fe5526daec2b6c141c0d6004991eb39b9aa69a37eb9f0d11abd9aab02970eb0241fef8dcff39c71831c05e69d67eacdac0290c1e383020abc12333c79f670c5d0f400d0684c1178083b442010c42eebefdf43f46eedeffdd7f1783beb6d5635c7fe117e592ecf4ce7b81b8704ec3907e1585544b4650d5111e117c6e8a138cbec142566c9f3820504aa24a76c82d5617baf3fd6329c589ce8e74b949c6817e0a0330608aad5d9e88264e1266ab4d138b347d9c9de36ffc263d62a2d79645b16f0fad3a6b0375bdf7b41e11bb5200b4cb054c995d452fe2156b5e77317c3016ee0fdd70124bcdd6a687c866526d8f1b0dde59db12564996d648efb121a6ad32805761c0ab20fcc6e7a1bef2960dd355f6ca795a22a826babff3cd690683ed650be4fe4b49a0fa9059bed47627f769a65f89246c63baf793dbb2ddaab5ed196f83ff13b0b9ad2a3375c43b78fa677d4c49e72051ba74929c255b5b2bfe90d981635c68747776834f99d32f44a4d3a6055f568f22027af12e51d9ff970305ec0c2a292bf9897985d90f246878951929b9d9805fb556675319f61ee8fb77d9654838cabf27bab991231550ec44a25a57bac73c06b693082c4077bb5c394a1caa89ccf58ebca650cc777cf2e2d7e3f38a6e766a1531551bf9dab668771e3d4cd2d2c0baf6683c77a42314138e19743d2d9b4c6bfcbc79d84cfd375e5e80b3782a094f50ec705a72da9785666196f601084da4d29179f50bdcc05836204b8e24ac2123780e2c3a74270d5569aa838d9b2090c56c6ede14498a33996d2750099d1dcc176b3dd59c480419f2e405f179c9c11526f902ece2f1d206835b6469bbf38e5f3a9f1e0b4dd5e0b6b822cb5fb51d54651c09e69060167394fb738def7e25beb8475e4f6c114c3209501238597d71b2c6cc53354a21b99a319a225830180c1586b9299d563a277ee3adba50e9f7cac824462d09f61689a96ea22cd49afb77cda43aa843fc59700ceacbf963dc881dbd289f5259c9f30725dd859e7f4151f770493fb8b081d09d4c5a1568b2fdd65aa2fa8dc4b8599201f162a188ccc7dff5ab27ae8ccc7759c776d5237570b52c008bb53dcced8a53ba6ef0d4f819493d4bb2674d420cfc7d6ab9d4747657db9d9ee9673660115b615a663c68a3e0dc0fcdb21e9092ec8119e21030bb61d389cd88b82baa7146402bd5eeea62e295279826fc516c98b9be0ddfc8c9a8424e0a679f598529a3f930a3649090aa858bc1d3a272505a0a5530415ab6dd43cfe9a5d6d7dc1e317bcab31718d01dbc2dccfe4696d136c5e003eee74bfd1ff5c5ab52a785485f7dd98b57caccc3944ef8d64f8ac14c2b70bea1717c99d94341d171897ea18d2d0ab9da56674aae5eb4bb9066e26419d741bb4bd34388e03501fe17045a8ba149d98f7e16e923b732690e543ac74ba2dbb53cfc6313232516b39dcd6f2237b06263b5335f8f7617ee808fbecac1d68a58aabc7993db2021dbf3b7dffd3cb7aa38d1627362187735603cfb9495287061aa222cd84dc3157d7a4ff6cd65192d68fe7a8d5f665966df478f19e286f1e781f78c96f190b2f67d7450c4899b38906491240e12beb9eaa0210fc88ddc2f03b07cfd27c023b4ca71f60a5509196d044337ccb8e86979db9e404a7b2fe342f493f3896f41570b2b22d2f1c21f36b817ac083fc8ccf6e0b952706b5a3f675625e472fe8bd4c93dbb737bb70a588b5cdf366835674f0187f03ec4b6cfb0efbf3d59d47b5a25fba2a953fe70ed151de8952ae63a87057d9cddba8a576a3e2f1060026a7376d5a83e581754ecc9f85bf58f6ff908bf3302fcbc81c7439828b8e6efebeb1ab7a19cdf8c50e3e7f46c36d88eff19aaf4866caaf10db77a630931e4bd00e9f191e4440f54c15ac8ffe96affcb7aef6eda866a4fc4782ef31cbe9d5ac455077b3704a92dc03c02ccffcf1e978d9ccfb47a11555b21f7527c6a0db6e6fb07b1d3310a901973bf249757942b6b086af6ed1e73318e1af6daa9fb3108e71f12e3dab939f24b8a0c59b21e04ed6c0b204e64dfbf7d3cea1585b596e9b76da46918a0e986dad6a972fac2b95496f6afbb0e26e7bc883dde5c2e0142dc3c3ddf3f80629a97905c4ecd8294907587c78b4b8b40460d3d0472b7102c3ddb6bb4c9cbe0d63e75ecb989fda05ff2bcd5b458cf8043fecea074f1fc565db309732d31bae0a7aa30afacd60fc398b511a76a640ce6a4e50e18e77deb159f886b4eaaf26640d4e6c7c9f58b260fa5817763bd95f6da696fa8cd77b6973a692d2ab0a6a297202c6b4d998d74db3bbcb08be0c50b36b8bcbe96842f45aecc928bca90e511d6477c3e1dfc757d0deb0a4c574a6e9123d91456a323075ee3ec103bfcbcabdcb28d23b55c4646fb9546c167504a36401d9d612a1f83692ad19b6394a506d4fdf2acd566707263ba6e665a3f322257d2459d26c39840b576ca82c3508583aab71cb835f70b6142afc456830a6c39407106fc395b04016bea9f180dc483c88c6b7ed4fa819d18682755b8d23b74937360c1fbb9a33556961c0a690a8f5a02fb98dbbe0c28b80c5be87db350b64e66525399f047f6abc8afdbaac69359a4c0d4b4488830cad0a0c23b7c5bf2b49653d3d5e890c7da5464a7a0058d79d3b097c3c0007a513f07e7258f1b73f461791040169bafef6f6e4a561f4c2ec3e57972d0a0f641606e4b7610802996b0feb2931fd43b713c029ab8fd8334785e137e4bf77f7b157af8aaa287d8b9acdc0996ec8816cc1167ba1fac1acf2a88638004bb1e8b4788d475d34d53953dae8b22a33c8471bdb726f6bbcb946b0cdad057e6191d5f8428de2153b1b4649b61da677bf08c05ae09c6a928898c498a7e41b41343585354e1b5734d5f9b7844412602a1ffc3aca9e3a4a9feda027dbd1b5fbbf2d247ec7972e5408e0bf01906cd125f2650b2b6a702a5b8a0e5daa8167f063cf27c3581d40c8adf9708077d6e3f5718d16c5c204f88de4e07e523894b9899de205b1dafc6cedf3dc71dee9550658026a964f0934044691fef7cd921e579370de4a651faf7434a201f1b1065e2e4e3e58cd3d6dd979b367e7732f3fb95c91f2c3d6d957625106803dc80442392d9f9d5773be1fe59d48513c612591f0312da06ba4d8f2f46e88ca543a", @nested={0x7f, 0x78, 0x0, 0x1, [@generic="b0a0282f251d02a45b3885e6ab939e534f33148a2560717379254aa3138988f71545b009850ab9dd72427cd3e92d1bf22ff7f8521805be5a20e498365f0c61bc506a67a7d03a7d5db0986edb6598f4a251c628460e4074a81de4ab48d7990368d813382baabda1d97d2c107df6edcf9a129f3959f0ea98", @nested={0x4, 0x5f}]}, @nested={0x1e0, 0xa8, 0x0, 0x1, [@nested={0x4, 0x98}, @typed={0x6, 0x94, 0x0, 0x0, @str='-\x00'}, @typed={0xfc, 0x40, 0x0, 0x0, @binary="57436f9ebfb3f49e5e8bef6cb2c763e88b651981f65d856172f396e6057988db57011337e16ecfabc68743059b10cbdaa6d4afbe268ab139cfaeba1749307745316fa542acf2657eaffa9cc6d14ceccc252418abc86a47282e11a82ac8912ceece8d36c99ebf54c8ffde0b47d1aa42a958389d42556a3912a23dc33ba453ca524b3ac3e99500a8bdecf0a4ebfb9f3dbfa5d1cd4dafed53bef125a4bb81b9eca89179df8ab7d807605e0b0dd813bc45f30aafb9a38b657c18a3f45a81e2c763199986ed6b5d92586123ab63d101d506d9cb5ce96422e3390a4ee7c6b36d7bb6ea5da951a71aea9e4194568edc98481d9c6e0a980355280c0f"}, @generic="0ba0b3aec6bb4cee7052e06e6e38bd5eb7311f1b9b8ddf8861ed0fdf02c54fa839f1ff50281d7a834166dfc42c2ba08e166ae008dc10a4ce61ab1ca571980bf4123671f5dde4c26c1baf319d41d86edda1558f968f55b7e09466706100faf41f8b", @generic="92f1247bd22e9c5e5161875a83f0c4a7e4991aa4409191032045757148991c165782e09ebc7574c8ceb36dd2f336f7242db7581dcbfcf8be0004996f2d35cc4135218ef364045e1955cad8835d48e016608a1e562b5693739532398530bf195453cd2d", @typed={0x8, 0x39, 0x0, 0x0, @pid=r0}, @typed={0x8, 0xa7, 0x0, 0x0, @fd}]}, @typed={0x8, 0xa1, 0x0, 0x0, @pid=r1}, @nested={0x507, 0x146, 0x0, 0x1, [@nested={0x4, 0x14e}, @typed={0x103, 0x10e, 0x0, 0x0, @binary="f0d740367178fd08f81b147fd4f88bb14235c44291af1971104fda9369e162563c8f476fecfc1594b0596201fbea3abcded5197234da7dba16b983c6d40fba2f894f017dad2f54eaca33292fc03a7eb31246a8bf4f38c3f176e5d2f9438f5884e8c20f5cbe4e5bbc25086a1a3d071c1f1cffd4baf0b239524f62895af664977d1f916adc1f9ce120b00de302f513348c15d76b998ed2f4241c5bfb490766d2d05f0c9010bb094e5ee5e4f17915e3cee8839469956cac8a6d14b06877bde54bb197ea2841082965074df4853aa6bb34f21fba3f230cdbf88f7af0dbcad5b6ebd710795f03b8f16768cc77dff636d4bab0fba38a03b02e56e430d825154b9e50"}, @generic="c79dd5fc75278de5153dd7570ea23d2f307801a16849494c162ead3f359ac9a1aa04e44a93ad22748041ed7493bb9e035f9247cd3689221b503d08eaf132abd189d95e47b25e5822ea6a92c702d489d7ca2cd1c18a6350ed24cec72396e6323505c75adf61be397c10140fc4f75000647aebf8d933faa69b565a8cbc7690badd2ae72b72fc9d1227bb9053263b1beecd38653f430502c1974403", @typed={0x8, 0x63, 0x0, 0x0, @pid=r3}, @generic="fd31aaa4b02f8414865bf08beacdf31e487fb7eeab212956b5f01b14331eca7dd2a6f183fbcb3932156ca8ab51d2f8f274899c7426bb56a426eb37be43dbadbae80eb47fb8e5f2911c8437123a712415831872cd45091e7f00c8a6b5bae18c4d33827d168114ab1c34c4b64a5226a49ca231022c3a14522ddfa8ef22405005daf78c603f37e7b1e6d4a31af9244965121ad2e7e6405017317af2187c929ea04f6842ea5b6907394502d4d225ecd509384979d510fce8d977e14f77d7aab9f5271ade66519f0c673cfc790f9b523c34f590d5133962d6e8c5945be5fde5f5c37222e2ea19a327b9c91d222330736d", @generic="16f715dda48a28f35abe514412268571a9681b6d51d8f5d73959bb17167df1f51951c7a485e974c7c0ad3fed7328e983dffcd78016fe48f39611cc211621bf910632065a6664c8050991c5064d1b00584759fc80b7cb12ad754a1ca33454c39eb7f73814217a5f3da6f14bc2a2e8e1facfc90ab86e4a27a865cff4aa3f1b330867749cd0c138b8f82c53303b2ef17a538e0913a699180a1f4711bb9a1f463caeb13d5be2c1ea62152a884ad14a5eb1b06a0c5f2d342cb1f818c815f1ba2c8665a51941690c4468767ad6738d351e554e7726154697b17a22e533c16b58dc69a85bcbdbe45aab6b9b8ec1ddd2dc5e5045cdddfd2b9481ba4e6db92caf", @typed={0xb4, 0x149, 0x0, 0x0, @binary="90934af3e5bad6bd22e6cadd1babc4d6bf2dbab59eb3034ba29585b92d13bd513d6fc23232ee11bc184750a60d3d3540c69faeeb1f3b8b8650a5133323139b04cb8158d655d123d8b903949e2ed13321fb95e068d1f2472e6ce48cf19b78b740a9ae4384f57f572252f5485ca767983601ba2e31dc19b5c13160b2bd742be1c4ff18c479031374bdeed9faeb6f670af44d24a1d7a40233206503ef0330cefd3d3ff65606549747da2f4b6331f540d553"}, @generic="f65fe2c9233851684cb42c7a9fcd82f77e075f08e2bc9b561429792c2cc5299a32d2c18750a4602998c59023120873117132d4f6089b02c296407f0eb687e62638ee78222db41d4e42c6fcac67ea4ccb5093b72747e8dfb954bdb365666fe0bac30e069bbcdbd903843cb70ea5916057a82a6681fcd758397af94eb77f5e846e23064cee5b8908e326fad42284abd015fefda8338f2dd64acc6422eea58849c206e6d4cffba97cd35b5c15555431ade318cd9f164da85fed50ac17"]}, @typed={0x31, 0x57, 0x0, 0x0, @binary="500dfdc1676d1f50419f44105d893d8a2a29b79629919b1a35344ef40c0045d6ccd2f956b567ddf11d3479ad5d"}, @generic="b44073a989eb0a78e6429b4617bb3491add898ff65a3d75ab1922df0bfb3735d924a9377c212b210c77d7e8c5c8ecc21a57f5c00578cac255090644bfa42a3e4d835cea29358ade18633647ec4adf855a99600593085e99fe32e8ce1527af4bf14757ddc07f7d6f95d418951ebfebd332e3bdafd15d9195c7ec2d12171b5ff5e9d4266fdb83412d3c14cd8bbb2e4e595dc785c3061cd734c1acc59b49d65e04842dcb15b1564e45a35a841484efb5df76de18a43208028cd9fac165540a91b89cf0bf2e5b02fba6325cf7abb1d3f8d1cda143aedacc816906912534d356d17acabad87a8aad791445844", @typed={0xc, 0x3e, 0x0, 0x0, @u64=0xfffffffffffffffd}]}, 0x18b0}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r4, 0x0, 0x483, &(0x7f0000003b40), &(0x7f0000003bc0)=0x68) r5 = socket$igmp6(0xa, 0x3, 0x2) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000003c80)={'sit0\x00', &(0x7f0000003c00)={'ip_vti0\x00', 0x0, 0x0, 0x1, 0x81, 0x1000, {{0x16, 0x4, 0x1, 0x1, 0x58, 0x67, 0x0, 0x3, 0x4, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x28}, {[@timestamp_addr={0x44, 0x24, 0xb9, 0x1, 0x7, [{@local, 0xecf}, {@multicast2, 0xc}, {@broadcast, 0x8000}, {@broadcast, 0x7}]}, @timestamp={0x44, 0x10, 0xf6, 0x0, 0x0, [0x7fffffff, 0x10, 0x2]}, @ssrr={0x89, 0xf, 0x1f, [@multicast1, @multicast2, @multicast2]}, @end]}}}}}) setsockopt$MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000003cc0)={0xffffffffffffffff, 0x0, 0x1, r6, 0x5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000003dc0)={&(0x7f0000003d00)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000003d80)={&(0x7f0000003d40)={0x30, 0x20, 0x20, 0x70bd27, 0x25dfdbfb, {0xa}, [@typed={0x14, 0x101, 0x0, 0x0, @ipv6=@private2}, @typed={0x6, 0x2, 0x0, 0x0, @str=':\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000003e00), 0x2, 0x0) write$FUSE_OPEN(r9, &(0x7f0000003e40)={0x20, 0xfffffffffffffff5, r2, {0x0, 0xe}}, 0x20) (async) r10 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000003e80), 0x804, 0x0) (async) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000003f00), r8) sendmsg$TIPC_NL_PEER_REMOVE(r10, &(0x7f0000004240)={&(0x7f0000003ec0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000003f40)={0x2b4, r11, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4b}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfa}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8773}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xdc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xcc}]}, @TIPC_NLA_SOCK={0x84, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x401}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xd449}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER={0x13c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xfffff6f1}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'geneve1\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x96}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xfffffff8, @empty, 0x2}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x4, @remote, 0x8000}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x3, @loopback, 0x5d99d39a}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, '\x00', 0x2f}, 0x1000}}, {0x14, 0x2, @in={0x2, 0x4e21, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @mcast1, 0x10001}}, {0x14, 0x2, @in={0x2, 0x4e22, @private=0xa010102}}}}]}]}, 0x2b4}, 0x1, 0x0, 0x0, 0x40000}, 0x40) (async) write$midi(r10, &(0x7f0000004280)="20cbde16c60f59135e002b75e19ac65f98adb1f5d4976bc3a062cdcaae6be851668914460dc0bd0048814c5c174d54c9", 0x30) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000004540)={r10, 0x20, &(0x7f0000004500)={&(0x7f0000004380)=""/193, 0xc1, 0x0, &(0x7f0000004480)=""/90, 0x5a}}, 0x10) (async, rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000004600)={{r7, 0xffffffffffffffff}, &(0x7f0000004580), &(0x7f00000045c0)=r10}, 0x20) (rerun: 32) r14 = openat$full(0xffffffffffffff9c, &(0x7f0000004640), 0x4000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000004700)={0xb, 0x7, &(0x7f00000042c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffff801}, [@alu={0x7, 0x1, 0x9, 0x6, 0xa, 0x6, 0x4}, @map_fd={0x18, 0x3, 0x1, 0x0, r10}, @jmp={0x5, 0x0, 0x8, 0x1, 0x8, 0xfffffffffffffffc, 0x1}]}, &(0x7f0000004300)='syzkaller\x00', 0x10, 0x0, 0x0, 0x41000, 0x71, '\x00', r6, @fallback=0xf, r10, 0x8, &(0x7f0000004340)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, r12, 0xffffffffffffffff, 0x2, &(0x7f0000004680)=[r10, r13, r14, r10, r10, r10, r10, r10, r10], &(0x7f00000046c0)=[{0x0, 0x4, 0x9, 0x9}, {0x4, 0x1, 0x2, 0x5}], 0x10, 0xffff8000}, 0x94) (async) signalfd4(r13, &(0x7f00000047c0)={[0x5]}, 0x8, 0xc0000) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r14, 0x80089419, &(0x7f0000004800)) (async, rerun: 64) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f0000004840)={'bridge0\x00', {0x2, 0x4e22, @loopback}}) (rerun: 64) setsockopt$MRT6_ASSERT(r14, 0x29, 0xcf, &(0x7f0000004880), 0x4) (async, rerun: 32) fcntl$addseals(r13, 0x409, 0x8) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x4, r1, 0x1, &(0x7f00000048c0)) (async) socket$inet_smc(0x2b, 0x1, 0x0) 35m6.790155084s ago: executing program 2 (id=65): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r0, &(0x7f00000007c0)={&(0x7f00000002c0)={0xa, 0x4e22, 0x46d74c6e, @mcast2, 0x5}, 0x1c, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000002900000004000000320000000000000014000000000000002900000034000000000000002900000014"], 0x48}, 0x46830) 35m5.726402696s ago: executing program 2 (id=71): mount_setattr(0xffffffffffffffff, 0x0, 0x300, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB="10010000160001000000000000000000fe8000000000000000000000000000aaff01000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe880000000000000000000000000001000000006c"], 0x110}, 0x1, 0x0, 0x0, 0xc1}, 0x0) mprotect(&(0x7f000007b000/0x12000)=nil, 0x12000, 0x5) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$video4linux(&(0x7f0000000380), 0x2, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) r3 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000900)={0x1d, r4, 0x1}, 0x18) sendmmsg$unix(r3, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000001c0)="bb", 0x1}], 0x1, 0x0, 0x0, 0x48c4}}], 0x1, 0x1d3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000080900010073797a3000000000ec020000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000004a8020980c00002801c0001800800014000000006080001400000000e08000140000000062c0001800800014000000005080001405167e70f0800014000000004080001400000004008000140000000071c00018008000140000009d40800014000000fff080001400000c3ce0c0001800800014000000fff4c00018008000140ffffffff080001400000007f080001400000000708000140000a000008000140fffeffff08000140000000030800014000000003080001400000000808000140000000eb340102801c0001800800014000000000080001408000000108000140000000032c00018008000140000000080800014000000401080001400000002f080001400000004008000140000000020c00018008000140000000080c000180080001400000009014000180080001400000000d080001400000000954000180080001400000c2b60800014000000bf40800014000000009080001400000000108000140000000010800014000007fff0800014000000005080001400000000d080001400000010008000140000000023c0001800800014052d961dd0800014000000001080001400000000008000140000000b40800014000000005080001400000000408000140000000032c000180080001400000000408000140000000090800014000000002080001400000000508000140000007ff080001"], 0x334}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000008c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000880)={&(0x7f00000007c0)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r2, 0x0, 0x8e) mknodat$loop(r7, &(0x7f0000000140)='./file0\x00', 0x4, 0x1) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000808000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x10) syz_usb_connect$uac1(0x5, 0xe0, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x1ce, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xce, 0x3, 0x1, 0x3, 0x10, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x88}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x9, 0xf, 0x1002}, @as_header={0x7, 0x24, 0x1, 0x2c, 0x81}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0xf, 0x2, 0x8, 0x6d, "e9"}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0xa, 0x1, 0x3, 0x5b, "2bef"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x5, 0x4, 0x36, 0xfe, '?>9'}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x40, 0x7, 0xc4, {0x7, 0x25, 0x1, 0x0, 0x79, 0x5080}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x6, 0x2, 0x6, 0x4, "0fdefb7c"}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x7, 0x4, 0x9, 0x3, "683790f461de"}, @as_header={0x7, 0x24, 0x1, 0x71, 0x2, 0x1}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x0, 0x9, 0x2, 'S\b'}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x0, 0x2, 0x80, 0xf, "efa0a7"}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x5, 0x7, 0x1, "f37874"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x3, 0x0, 0x7, {0x7, 0x25, 0x1, 0x80, 0x2, 0x8c}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x48, 0x4, 0x6, 0xff, 0x4e}, 0x2a, &(0x7f0000000180)={0x5, 0xf, 0x2a, 0x4, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x6, 0x7, 0xe}, @ssp_cap={0x14, 0x10, 0xa, 0x2, 0x2, 0x0, 0xf000, 0x2, [0xffc0c0, 0xf]}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x1, 0x4, 0x997f}]}, 0x6, [{0x3b, &(0x7f00000001c0)=@string={0x3b, 0x3, "6ec1ea19321fff5e92126a249be045cc9c1b297d6a07e64d1834f33bd2556226aea52a6dcfa32f9a5f805ac3a8e0b8527496c2cc9e7484243e"}}, {0x8d, &(0x7f0000000200)=@string={0x8d, 0x3, "81e9762b0f45bf26becbc79dc033fb5db9448d713de7b4e264e8b65ed4ccdb8c2e600eae00db4c1cc9a0d0a5a78384de954d223ea2265a71ad2651873fb04c20f280cb7ba883c8c22e3cff3c85dc63c0d823d5842af649cd92ee86ae68133f3c1b7d2e68c045da026e37386d087a744a1d185b6bfc39da9bcda932ba5a4a65259ae652b3396b90026f40ee"}}, {0xf4, &(0x7f00000003c0)=@string={0xf4, 0x3, "da3bd9662a8f907b3b69f49ad2714d189574374609b3beebbf398b40e31f2acfc347891d4b4f024a1839f10d31d57a1eebd66d781c9f0770f75b46949eceba59acf5b166b7653b081aac61b65864bdc3577192859de3c30f1a156aff3b1fd8e1335da39dd9928677595729d3953af4427930ae3e495fc084dd7a84a6e04c8cbda436f0f565e1a292db8093289f7ed31188dbe46bcbf4d1ab29c4537769430973362f18f40208850c423b4f960b80b51816749f441120f56bbeb665e539986b5dc60c706c220b98cfbf2e90c81fc82aec4f6217dd64fc1b3c4506020f945f0912feb9d25cd8beb456d2147cc3be209c2309c8"}}, {0x6d, &(0x7f00000002c0)=@string={0x6d, 0x3, "fafdf037d0e327fa1949ccd4aae551762eef9291957bc9a4ca3890af8acfaea98592898f7a616b7a34c472c1354e1e3853c8c050a30cf26042850ade12af378378a077bd9420b080b1218e2cc36c44e358919f7ae9123e9fb1120671966bc28920ff46990f91102fc72f5d"}}, {0x81, &(0x7f0000000540)=@string={0x81, 0x3, "85c5d8846f30a37ae65fad774d7d820eb58ca273b2be4fa6b4329beeecb11911fbf5b9c0e6440dfce13a12f8da0e9800a1f16e93fe4c3a5e19de25f70ee935fbb8f942f846b23b996b9ae5d54261d2acb4a7a2bbaa5ab3606d6b8b0a6211af94798ffc5f217d955eed473c377fb2e232579a87cb50fc1a25e430ddd454c419"}}, {0xa2, &(0x7f00000006c0)=@string={0xa2, 0x3, "d6dc6fec38730c67d23825db7df6a3b9244642fe32712c071ca7576c2e214e7777813047ec9a15477c2dad14a56aefce1672df8a7ced0d14da80197c3c741938f78ea0a895b1f3db827a2821a68b012e581e803c7d5ae175db4c89d25122d23117de86d51b987341662ffd4752987f4c35f0581879ecec6c9b26fc3ec589f3e06b80de29c53b66a345bffc5932bf5119688e5a723d2ee9cac29d7fcc26ef7eb0"}}]}) 35m0.577383799s ago: executing program 2 (id=82): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$rtc(0xffffffffffffff9c, 0x0, 0xe2803, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_WKALM_SET(r2, 0x4028700f, 0x0) close_range(r2, r2, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$radio(0x0, 0x2, 0x2) socket$l2tp6(0xa, 0x2, 0x73) ioctl$VIDIOC_S_TUNER(r4, 0x4054561e, &(0x7f0000000040)={0x0, "a055babd9b8c29abbdd772a44c5518bc1661222efc50f8f5555dcf4617da81d7", 0x5, 0x400, 0x3, 0x5, 0x2, 0x4, 0xfffffff9, 0x5}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x14}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x6}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) 34m48.026478494s ago: executing program 2 (id=129): r0 = open(&(0x7f0000000140)='./file1\x00', 0x2a4c0, 0x30) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000002c0)=0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) r4 = getpid() write$cgroup_pid(r3, &(0x7f00000000c0)=r4, 0x12) r5 = getpgid(0x0) syz_clone3(&(0x7f0000000500)={0x40010000, &(0x7f0000000040), &(0x7f0000000100), &(0x7f00000001c0), {0x2d}, &(0x7f0000000400)=""/249, 0xf9, &(0x7f0000000640)=""/194, &(0x7f0000000300)=[r1, 0x0, r4, r5], 0x4, {r0}}, 0x58) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r10, 0x4008ae9c, &(0x7f0000000000)={0x16, 0x5, 0x7d}) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=r11, @ANYBLOB="010000000000000000001a0000000e91907d01419457e8199234e498ed7952f328367af201bc5d2f3c9ceb3bee76784185d6c19bc1468e7a325780119ada555bee7ffe4dbd0149cebd91d0b870600ae8a74e482d0d2876d08d90597e0900"/112], 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x0) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f0000000340), 0x0, 0x22, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r13 = socket(0x1000000010, 0x80002, 0x0) r14 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r14, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) ioctl$sock_kcm_SIOCKCMUNATTACH(r13, 0x89e1, &(0x7f0000000000)={r7}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r14, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r14, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r14, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x800, @loopback}, 0x1c) shutdown(r14, 0x2) 34m43.929404736s ago: executing program 2 (id=142): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000180)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @multicast1}, {0x2001, 0x880b, 0xc, 0x0, @opaque="75d00021"}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8101, 0x0, 0x7, 0x0, 0x3ff, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x18}}, 0x0) getsockopt(r5, 0x200000000114, 0x271e, &(0x7f0000032580)=""/102390, &(0x7f0000000040)=0x18ff6) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f0000000140)={0x15, 0xffffffffffffffc7, 0xfa00, {0xffffffffffffffff, 0x1, 0x30, 0x30, 0x0, @in={0x2, 0x4e23, @broadcast}, @ib={0x1b, 0xd9, 0x100fff, {"4a50abf0c8fa50f638facd57de499163"}, 0x8000000000000001, 0xfffffffffffffffe, 0x3}}}, 0x118) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x4734}}, 0x10) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x9237, 0x149441) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r6, 0xc01064bd, &(0x7f0000000100)={&(0x7f0000001cc0)='1', 0x1}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) 34m28.337416455s ago: executing program 32 (id=142): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000180)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @multicast1}, {0x2001, 0x880b, 0xc, 0x0, @opaque="75d00021"}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8101, 0x0, 0x7, 0x0, 0x3ff, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x18}}, 0x0) getsockopt(r5, 0x200000000114, 0x271e, &(0x7f0000032580)=""/102390, &(0x7f0000000040)=0x18ff6) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f0000000140)={0x15, 0xffffffffffffffc7, 0xfa00, {0xffffffffffffffff, 0x1, 0x30, 0x30, 0x0, @in={0x2, 0x4e23, @broadcast}, @ib={0x1b, 0xd9, 0x100fff, {"4a50abf0c8fa50f638facd57de499163"}, 0x8000000000000001, 0xfffffffffffffffe, 0x3}}}, 0x118) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x4734}}, 0x10) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x9237, 0x149441) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r6, 0xc01064bd, &(0x7f0000000100)={&(0x7f0000001cc0)='1', 0x1}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) 24m59.65570302s ago: executing program 0 (id=2788): syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x217, @time={0x65757100, 0x8000008}, 0x0, {}, 0x67, 0x2, 0x2}) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) ptrace$getregs(0xc, r2, 0x5, &(0x7f00000006c0)=""/248) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x80}, 0x1, 0x0, 0x0, 0x840}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="170ee4ffffff00000000010000600500070000000000080009000000000014001f000000000000000000000000000000000008000a00000000000600020001000000140020"], 0x5c}}, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x8800) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f0000000000)) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r5, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0={0xfc, 0x0, '\x00', 0x1}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x84}, 0x80) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socket$kcm(0x29, 0x5, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000014d00)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfa, {0x0, 0x0, 0x0, r10, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x2c, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0x7, 0x7ffffffe, 0x8, 0xf1d5}, 0x2}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa1d}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000500)={0x2000, 0x8000}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, 0x0, 0x312, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x844}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x8044}, 0x0) writev(r0, &(0x7f0000001880)=[{&(0x7f00000005c0)='~', 0x1}, {&(0x7f0000000680)='T', 0x1}], 0x2) 24m56.447791386s ago: executing program 0 (id=2804): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x6e0, 0x0, 0x540, 0x540, 0x540, 0x1d0, 0x610, 0x610, 0x610, 0x610, 0x610, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [0xffffffff, 0xff000000], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1d0, 0x0, {0x7a00000010000000, 0x540}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2}}, @common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x0, 0x80]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@private=0xa000000, @ipv4=@empty, 0xa, 0x30, 0x1}}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x0, 0x0, 0x0, 0xffffff00], [], '\x00', 'bond_slave_0\x00', {}, {}, 0x2f, 0x9}, 0x0, 0x168, 0x1a0, 0x48000000, {}, [@common=@ah={{0x30}, {[0x4d2, 0x4d3], 0xa000000, 0x4, 0x3}}, @common=@srh1={{0x90}, {0xc, 0x2, 0x4, 0x8, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, @private1, @private0, [0xff, 0xff000000, 0x0, 0xff000000], [0xffffffff, 0xffffff00, 0x0, 0xff], [0xff000000, 0x0, 0x0, 0x80], 0x804, 0x400}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x6, 0x5}, {0xffffffffffffffff, 0x6, 0x1}, {0x0, 0x4, 0x2}, 0xfffffffe}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x740) 24m56.223516642s ago: executing program 0 (id=2805): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb146000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000005, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000000)='GPL\x00', 0x9, 0xff4, &(0x7f0000001840)=""/4084, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800064}, 0x94) 24m55.91975395s ago: executing program 0 (id=2808): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="2800000009000000000000000000000001"], 0x28) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000040)=0xd) ioctl$SNDCTL_DSP_SETFMT(r1, 0x40045010, &(0x7f0000000080)=0xd8e0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="2800000009000000000000000000000001"], 0x28) (async) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) (async) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000040)=0xd) (async) ioctl$SNDCTL_DSP_SETFMT(r1, 0x40045010, &(0x7f0000000080)=0xd8e0) (async) 24m55.529645956s ago: executing program 0 (id=2811): r0 = socket$kcm(0x2, 0xa, 0x2) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = epoll_create1(0x0) r2 = dup3(r0, r1, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000009000000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000020008500000083000000bf090000000000005509feffffff00009500000000000000bf91000000000000b7020000010000008500000085040000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x1005, &(0x7f0000002840)=""/4101}, 0x94) 24m54.775387842s ago: executing program 0 (id=2816): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000100)=@hat={'permhat ', 0x2}, 0x1b) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x100) write$char_usb(r1, 0x0, 0x0) syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f0000000380)) (async) r2 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0x403, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0x403, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) (async) close(r5) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r6, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = accept(r5, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, 0x0, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r10, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, 0x0, 0x100, 0x70bd25, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, 0x0, 0x100, 0x70bd25, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000906010200000000000000e60007000008"], 0x14}, 0x1, 0x0, 0x0, 0x8000085}, 0x24004800) (async) sendmsg$IPSET_CMD_ADD(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000906010200000000000000e60007000008"], 0x14}, 0x1, 0x0, 0x0, 0x8000085}, 0x24004800) 24m39.466570519s ago: executing program 33 (id=2816): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000100)=@hat={'permhat ', 0x2}, 0x1b) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x100) write$char_usb(r1, 0x0, 0x0) syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f0000000380)) (async) r2 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0x403, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0x403, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) (async) close(r5) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r6, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = accept(r5, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, 0x0, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r10, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, 0x0, 0x100, 0x70bd25, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, 0x0, 0x100, 0x70bd25, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000906010200000000000000e60007000008"], 0x14}, 0x1, 0x0, 0x0, 0x8000085}, 0x24004800) (async) sendmsg$IPSET_CMD_ADD(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000906010200000000000000e60007000008"], 0x14}, 0x1, 0x0, 0x0, 0x8000085}, 0x24004800) 15.800051717s ago: executing program 3 (id=7122): r0 = syz_open_dev$media(&(0x7f0000000b40), 0x2e15, 0x8540) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) open_by_handle_at(r3, &(0x7f0000000040)=@reiserfs_2={0x8, 0xfe, {0xb}}, 0x55117e) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)=@o_path={&(0x7f0000000280)='./bus/file0\x00', 0x0, 0x8, r1}, 0x18) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0xa, 0x8, 0x5}, 0x0) socket$unix(0x1, 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="020e000010000000000000000004830008001200000001000000ff000000400000001ea0abff7f00000000000000d41f9ab9000100700000ebdf000008000000c4fc0000100000000000e2ffff1c004f030006000020080002000080f5008e24ce6e4ae300a5000003000500001e001e02"], 0x80}}, 0x4814) r6 = socket$key(0xf, 0x3, 0x2) sendmmsg(r6, &(0x7f0000000180), 0x229ffa1c4ce5369, 0x3000000) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f00000001c0)={0x80000000, &(0x7f00000011c0), 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='pids.events\x00', 0x0, 0x0) 13.617919411s ago: executing program 3 (id=7128): syz_emit_ethernet(0x5e, &(0x7f0000000340)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x28, 0x2c, 0x0, @dev, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @local}, @mcast2}}}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) listen(r1, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x4, 0x0, 0x5374}, 0x1d, [0x8000, 0x78, 0xf, 0x2, 0x80, 0x2, 0x203, 0x7e, 0x4, 0x4b, 0x39cc1919, 0x40, 0x29, 0x5, 0xffff2d37, 0x881, 0x6, 0x3, 0x0, 0x5, 0x4, 0x3, 0x5, 0x3c5d, 0x1, 0x0, 0x9, 0x2, 0x15bb, 0x2, 0xe65f, 0x3, 0x7, 0x80003, 0x7fff, 0x7, 0x80000000, 0xa72, 0x3, 0x7, 0x4, 0x71, 0xe, 0x5, 0x1, 0x5, 0x9, 0x3a, 0xffffff7f, 0x6, 0x6, 0xfffbffff, 0x5, 0x4, 0x8, 0x0, 0x80, 0x2, 0x4, 0x9, 0x8, 0x7, 0x1f, 0x40], [0x10000007, 0x3, 0x800, 0x8000, 0x10, 0xffeffff3, 0x8, 0x200c7, 0xf9, 0x10, 0x2bf, 0x6c9, 0xfff, 0xfffffffc, 0x5, 0x0, 0xd14, 0x5, 0x2f, 0xe, 0x4312, 0x7c, 0xea4, 0x0, 0x4, 0x22, 0x8000, 0x40009, 0x400, 0x401, 0x6, 0x1, 0xfe, 0x5, 0x5, 0x5f31, 0x7f9, 0x5, 0x2, 0x2, 0x9, 0x0, 0x9, 0x8, 0x800000d, 0x88da, 0x2007, 0xd, 0x1, 0xfe000000, 0x10002, 0x2, 0x7b, 0x9, 0x3, 0x3, 0x8, 0x1, 0x7, 0x3, 0x9, 0x48c93690, 0x1000042, 0xffff], [0x7, 0xf5fd, 0x0, 0x5, 0x1, 0x100, 0xa, 0x9, 0x800003, 0x7fff, 0x5, 0x5, 0xf, 0x4, 0x5, 0x20000005, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0xa, 0x5, 0x200, 0x5, 0x3, 0x8, 0x8, 0x6cfc, 0x5, 0x39, 0x7, 0x200, 0x80, 0x3, 0x4e0a, 0x7, 0x1000, 0xa2, 0x7, 0x5, 0x3, 0x6, 0xac8, 0xffffffff, 0x2, 0x11, 0x7ff, 0xfffffff9, 0x0, 0x10000, 0xffff, 0x2b98, 0x1, 0x4, 0x120000, 0xbe, 0x0, 0xa2ed, 0x1, 0x25], [0x9, 0xbb31, 0x7, 0xb, 0x5, 0x20000003, 0xa, 0x80000006, 0x0, 0x5, 0x7d, 0xc9, 0x6, 0x6, 0x8, 0x57b, 0x7, 0xffff, 0x6, 0x7ffd, 0xfffd, 0x4, 0x20002, 0x5, 0xe8a0556, 0x2, 0x14c, 0x3, 0x6, 0x6, 0x3, 0x80000000, 0x5, 0x8, 0xce, 0xee1, 0xfffff000, 0x179, 0x3, 0x7e, 0x100, 0x9600, 0x56e, 0x2, 0x1007, 0x40000006, 0x1, 0x0, 0x8, 0x4, 0x30b1d693, 0xa1f, 0xc, 0x800007, 0xfffffffe, 0x3, 0x0, 0xffff, 0x8000007, 0x2bf, 0x3, 0x200, 0x7fffffff, 0x2]}, 0x45c) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r4, @ANYBLOB="0fff000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) 13.380075865s ago: executing program 3 (id=7130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002180)=ANY=[@ANYBLOB="300000000d0a010800000000000000000a0000010900020173797a02000000000000000073797a310000000004000380"], 0x30}, 0x1, 0x0, 0x0, 0x24008811}, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYRESDEC], 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x220000, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") r3 = socket$inet_mptcp(0x2, 0x1, 0x106) recvmmsg(r3, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}, 0x7fff}], 0x1, 0x40, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, r1) ptrace$getregset(0x4205, r2, 0x1, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0x70}) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_int(r4, 0x29, 0x21, &(0x7f0000000000)=0x7fffffff, 0x4) connect$inet6(r4, &(0x7f00000014c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000c40)=[{{&(0x7f0000000080)={0xa, 0x4621, 0x9, @mcast1, 0xa}, 0x1c, 0x0}}], 0x1, 0x80c4) sendmsg$AUDIT_SET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x3e9, 0x8, 0x70bd2e, 0x25dfdbfb, {0xb, 0x0, 0x0, r2, 0xb, 0x9, 0x9, 0xfffffe60, 0x0, 0x7, 0x81}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4810}, 0x4000000) 10.19197506s ago: executing program 3 (id=7142): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r1, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000080)={@remote, r3}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x1, 0x4, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4840) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x0, &(0x7f0000000100)}) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x54c, 0x9cc, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x8, [{{0x9, 0x4, 0x0, 0xf7, 0x4, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xffed, 0x2a, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xca}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380), 0x1c0002, 0x0) write$vga_arbiter(r8, &(0x7f0000000180)=@other={'lock', ' ', 'mem'}, 0x9) write$vga_arbiter(r8, &(0x7f0000000500)=ANY=[@ANYBLOB="6465636f646573206e6f6e650016ebd79f667a37426fe5de48d72003dd693ca31d610e5148d90cf3233a8fb1ba483209b043807e441711901ac57596aaf0270db3d2ab0cbc36ce76e32473be2637cb"], 0xd) syz_usb_control_io(r7, &(0x7f0000000000)={0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="c951e3d107361200000721940977459b"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={0xffffffffffffffff, &(0x7f0000000780)}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) close_range(r6, 0xffffffffffffffff, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) modify_ldt$write(0x1, &(0x7f0000000340)={0x8, 0x20000000}, 0x10) socket(0x840000000002, 0x3, 0xff) 8.125221128s ago: executing program 6 (id=7148): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c02000014000100fcffffff10000000ffffffff000000000000000000000000ac1414bb00000000030000000000000300000000ffff20000a"], 0x23c}}, 0x0) 7.930815821s ago: executing program 6 (id=7149): r0 = socket$kcm(0x2, 0xa, 0x2) r1 = epoll_create1(0x0) r2 = dup3(r0, r1, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000009000000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509feffffff0000950000000000000ebf91000000000000b7020000010000008500000085040000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x1005, &(0x7f0000002840)=""/4101}, 0x94) 7.782543107s ago: executing program 6 (id=7152): r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0x1c, "da1a1a41466280017be04130a71b2e7ca2c911448ab1b7c5d5aa42a8"}, &(0x7f0000000040)=0x24) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x0, 0xa}, 0x20) symlinkat(&(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00') sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = io_uring_setup(0x423b, &(0x7f00000002c0)={0x0, 0x2002641, 0x2, 0xffffffff, 0x28b}) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, {{0x0, 0xfffffffffffe}}}, 0x28) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r6, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r6, 0xe, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000040), 0x0}, 0x20) setxattr$trusted_overlay_origin(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300), &(0x7f0000000340), 0x2, 0x0) r7 = gettid() sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x2a94, 0x60004}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0xffffffffffffffe3, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_PID={0x8, 0x13, r7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24008080) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000380)=ANY=[@ANYRESOCT=r0], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x2, 0x0, 0xfffffffd}, 0x10}, 0x94) 7.703267054s ago: executing program 4 (id=7153): openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc8902, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x400, 0x1, 0x800021d}, &(0x7f0000000dc0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) 6.591560568s ago: executing program 4 (id=7156): openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc8902, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x400, 0x1, 0x800021d}, &(0x7f0000000dc0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5.904124104s ago: executing program 6 (id=7157): openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000a80)={{0x405, 0x6, 0x401, 0x7, 'syz1\x00', 0x81}, 0x1, [0x6, 0xfffffffffffffffa, 0x95, 0x6, 0x2, 0x60, 0x1, 0xf, 0x1, 0x4, 0xfffffffffffffffd, 0x63, 0xfff, 0x100000001, 0x3, 0xc8, 0x51, 0xa5, 0x0, 0xb6, 0x80000001, 0x8, 0x7, 0x4, 0x6, 0x3, 0x1, 0x4f51, 0x0, 0x37c7, 0xc, 0xbb33, 0x0, 0x63, 0x4, 0x4, 0x8, 0xffffffffffff8000, 0x6, 0x8, 0x8, 0x0, 0x8, 0x401, 0x4000000003, 0xc1bd, 0xffffffff, 0x8000000000000001, 0x3, 0x4, 0x7, 0x800000000000074, 0x9, 0x2, 0x6a44d0ea, 0xffffffffffffffff, 0x9, 0x5f0, 0xfffffffffffff2e2, 0x8, 0x4, 0xfffffffffffffffd, 0xb, 0xf0, 0x26e69302, 0x5, 0x2, 0x5, 0x5, 0x1, 0x9, 0x7, 0xe0000000000002, 0xd, 0x81, 0x800000000001, 0xf, 0x6, 0x7, 0x3ff, 0xffffffffffffcc1c, 0x10000, 0xfffffffffffffffb, 0x6, 0x100000001, 0x1, 0xc, 0x7de, 0xfffffffffffff000, 0x8d6, 0x3, 0x5, 0x4, 0xafae, 0x1, 0x8, 0x1, 0xb, 0x1, 0xffff, 0x1, 0x10000, 0x1ff, 0xc, 0x0, 0x1000007, 0xfb, 0x0, 0x3, 0x7, 0xaad, 0x7, 0x1, 0x8, 0xe2, 0x6, 0x6, 0xf, 0x7, 0x0, 0x9, 0x5, 0x40, 0x52a7, 0x83d0, 0xf0, 0x8000, 0x140000000]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x10000035, 0x1, 0x100080, 0x0, 0xffffffffffffffff, 0x5, 0xfffffffc}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x103001, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x32002) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0xb, 0x10000}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x30, 0x0, 0x0, 0x5ae9}, {0x20, 0x7f, 0x4, 0xfdfff00d}, {0x6, 0x0, 0xfc, 0x3}]}, 0x10) sendmmsg$inet(r2, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 5.651871867s ago: executing program 4 (id=7158): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x18d1, 0x9400, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1, 0xfd, 0x1, {0x22, 0x4}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000140)={0x20, 0xb, 0x2f, {0x2f, 0x30, "b9d02d1fbb42de954ec615971eb4206a1a18d9405fe05a85b06532d3ca97d4e0b4f35a7179ba7831eca5a173c2"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000004800010000000000000000000a00806e0800001000000000140001800d2a79075827af5aa534d6815c2e93f10c0002"], 0x3c}}, 0x0) r2 = syz_usb_connect$rtl8150(0x6, 0x16, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r2, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x20, 0x11, 0x73, {0x73, 0x9, "fcbc511cf6a5688983a6964ee1dee48515abc82aaa237cab3c82c760be84b11220abfeeebcdb4820d8ec9ea16db850faab04abbd88c7b7381bbcf6ffb3ed79fe887d7ef707a968440b9a9ce97acbeaa9ee5021415ea5505e9fa08bb4605b9a8b81d7d8a6af35d2bc5a6a4952d876565857"}}, &(0x7f0000000180)={0x0, 0x3, 0x97, @string={0x97, 0x3, "6ee9dfa47a1a5340350cc5d3739c9c1d7d2cd37a9cb4617d7658711228265eb2e5815fbf0a7696ebd5a9988da4923bce5783a387f5ea4eb116f9b63f056e566de352c01b58b753f9729c5f9433a4a1c83b932912c514824f33c30c4496680b35041d961cdeb702e6ff70000868e493b6b66ebba8d17d2b14d05dc6e4608b4e0a6c208a7811256e24b3fbca6aac774412ba387610a6"}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000240)={0x20, 0xb, 0x1e, "276a146400a9f34d5e5c86361bd731b6ce060bf0ba1427de7c89dd83c509"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7f}, &(0x7f0000000340)={0xc0, 0x5, 0x6, "4a4832a278c0"}, &(0x7f0000000380)={0x40, 0x5, 0x2, "0690"}}) 5.181571892s ago: executing program 1 (id=7161): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x8, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000300)={0x2, @pix={0x1, 0x3ff, 0x32315559, 0x8, 0x203, 0x2, 0x7, 0x6, 0x1, 0x2, 0x1, 0x5}}) socket$rds(0x15, 0x5, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) close(r2) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000280)={'filter\x00', 0x0, 0x0, 0x0, [0xcf, 0x2, 0xffffffffffffb5b2, 0x3a8e5b6d, 0x9, 0x8]}, &(0x7f0000000200)=0x78) 3.828767962s ago: executing program 1 (id=7165): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000440)={0x100000011, @multicast2, 0x0, 0x0, 'none\x00'}, 0x2c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_SET_ELEM_DATA={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd4}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x237, &(0x7f0000000280)={0x0, 0x275, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r7, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x38, 0x0, @fd=r4, 0x100000001, 0x0, 0x0, 0x2, 0x1}) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000100)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRESHEX=r1, @ANYBLOB="81bd2bbd7000fbdbdf251400000018000780080002"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c8c5}, 0x80) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) 3.702539555s ago: executing program 4 (id=7167): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0x0, 0x800, 0x3, 0x1}, &(0x7f0000000340), &(0x7f0000000000)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CAP_X2APIC_API(r4, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, 0x2}) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x60, 0x0, 0xfffffffffffffd0b) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f00000001c0)={{0x0, 0xdddd1000, 0x0, 0xf4, 0x2, 0xfd, 0xd4, 0x1, 0x0, 0x4, 0x3, 0x6}, {0x10102006, 0xffff1000, 0xd, 0x9, 0x7, 0x3, 0x6, 0x5, 0x5, 0xf, 0x3, 0xca}, {0x6000, 0xdddd0000, 0x3, 0x0, 0x6, 0x7, 0x11, 0x1f, 0xc, 0x0, 0x6, 0x5}, {0x8000000, 0x8000000, 0xd, 0xfc, 0x3, 0x46, 0x2, 0xd, 0x6, 0x2, 0x0, 0x9}, {0xffff1000, 0x4000, 0x9, 0x7f, 0x3, 0x9, 0x9, 0x6, 0x7, 0x14, 0x2e, 0x4b}, {0x2, 0x4, 0x0, 0x26, 0x3, 0x6e, 0x1, 0xff, 0x3, 0x7e, 0x1, 0xfc}, {0xdddd1000, 0x6000, 0xb, 0x9d, 0x3, 0x2, 0x0, 0xb, 0x5, 0x81, 0x0, 0x78}, {0xffff1000, 0x2, 0xd, 0x5, 0x3, 0x3, 0xa, 0xfd, 0x5, 0x6, 0x2, 0x7}, {0x3000, 0x1}, {0xeefee000, 0x9}, 0xc000000b, 0x0, 0xdddd1000, 0x22a0, 0x9, 0x0, 0xe6e70c00, [0x1, 0x401, 0x0, 0xc5]}) ioctl$KVM_SET_LAPIC(r5, 0x4400ae8f, &(0x7f00000007c0)={"cfc8752a08b459c22211981d67fc3b1822b3b0da6a04654e1c351e111c62f087a30886e37771683102e190e7605effbae324dfce22c050b5cb06caa01193d6b4779c57bd49948b71ca7865efa8c93c807b92fa676fe763264f8a770dab16bd15f32369481f34a1fcf93787dd0f642c98b6dace47fe64538c4706257ad770ed973a878d59b1271c71730e4d0dc3298543efe507f2154472e53679644c09b57639c01e59dabdfade2ad385ecc6cb75ca1100b3f883bb092b769433e8cba7eac7bd350202f357773cce8e7c788bd250d2a5faad9da3e9ee9d5a0c052a0f82e45734c708148b45cffcb208622dbd0b5a18605f453ebd20770a9f3d0839df63b477d50a94ab0023d8f52223fc700ad74e8c9512b745ae82d952e635776da6c4264ab43f6c5198e460281d17aa23a27a97fb82f0073248aa7c3df76bde448af6ab8d22e7fa1f3a8e6cbec2deacdcf12f76891c60a9448ef50c6e06e8dc791d6b34f42a31defbaca876be47111d055497c9f039a3de690885d2c4a098277e356c9eb458a31fda780b82778cc32f1f5d62ab9afd9352e174b9b420bb55399f93a5310eb93bca35e34ec1a4c7ba28bfd8a0fb5fd879d4264709216679b9fe852329c35a912e25cac60756a452824fce4fba63754a0e2402ed506ffd7a23037f8eec9ca3e670aa3332da4d6514c64d1013dfda55b7fa071db419811f172e907a1c1fa2f34efb4ded276246b3140f5d61b7d1003b376fd0ea470c24c286327d528dd5110e5cc8826a1e2228f669b3e477eef1bde1ee76fb9afc5cb971faa0dbe4dff449541654640c198e2dc10fb5b79824c13b8e55919aa641a7297b92d09dae29d4429858e5d6d34d424fce911780f9e11aa74c17dde2b965b00ec5da7c302e21b7875093412ac2e17aed03c781280fde946c59977d82edfd385c3742928dcf31f1395f1199eb0f2b094425ea33bb29475ce2b18a4b3532a5cab2e7f35131356aee5d1052fbe31c457bab1d5fb140dc9488555c116bfd6cc82b5be3eb59a7caa5c0a8fbb0d19b7db4146de07088701042b772e093cc779c49764d329c8e2b9a1ac8551415d554e2dbaff7acf29c1b574592eab4f301f3d1a9318dbc4847f72908a199bd703a72c441be48f25103ab0925dea8b608096625530cc082026eddf3f9d349f2a8f68b86dfcc586c795dce98ef390da9b35b93212d9099cdff18ee96fcd8391098e93d9aca1a9d4b9f8e40a7867761d7aa0f2a845627953503098527bd07645b8c842e7a9dc6d92bdd85a0d2a8b9b209409a74736c5eb8e46fa5c6b3068a218f41919cbd7c69f71e15ee6e7effa87a56bfbbde790437774b0ec7add8947c510ce26947e2db1c89f9f9115785cd34df97b43165eca1183f4cb587307648333cae00304575784ba2e7a61b79052d505ba68f02b3103768352936aa2704b673c62b1b"}) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000bc0)={0x2, 0x0, @ioapic={0x33325000, 0x40b, 0xa, 0xfffffffc, 0x0, [{0xc, 0x6, 0x6, '\x00', 0xb4}, {0x83, 0x7, 0x4, '\x00', 0x4b}, {0xfc, 0xe, 0x7, '\x00', 0xf8}, {0x0, 0xd, 0x40, '\x00', 0x2}, {0x8, 0x10, 0x8, '\x00', 0xa8}, {0x2, 0x6, 0x6, '\x00', 0xff}, {0x6, 0xe, 0x47, '\x00', 0x6}, {0x5, 0x8c, 0x4, '\x00', 0xe9}, {0xe, 0x4, 0x8, '\x00', 0x1}, {0x5, 0x7, 0x6, '\x00', 0x4}, {0x2, 0x69, 0x15, '\x00', 0x8}, {0xe, 0x7, 0x6, '\x00', 0x7}, {0x4, 0x8a, 0x80, '\x00', 0xdd}, {0x3, 0xf1, 0x6, '\x00', 0x9}, {0x7, 0x65, 0xb, '\x00', 0xfd}, {0x6, 0x9b, 0x19, '\x00', 0x5}, {0x7, 0x2, 0x24, '\x00', 0xa}, {0xef, 0x6, 0x9, '\x00', 0x4}, {0xf, 0x6, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x3, '\x00', 0x4}, {0x1, 0x3, 0x7, '\x00', 0x4}, {0xd, 0x40, 0x7, '\x00', 0x9}, {0xfe, 0xfd, 0x7, '\x00', 0xff}, {0x92, 0x6, 0xfa}]}}) r6 = landlock_create_ruleset(&(0x7f00000000c0)={0x501b, 0x2, 0x1}, 0x18, 0x0) landlock_restrict_self(r6, 0x5) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x1, 0x0, 0x4, {0x9, 0x21, 0x7b37, 0x1, 0x1, {0x22, 0x35e}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x10, 0x6, 0x7}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x2, 0x6, 0x0, 0x10, 0xf}, 0x0, 0x0}) syz_emit_ethernet(0x3e, &(0x7f00000002c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x8, 0x3a, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[], @echo_request={0x80, 0x0, 0x0, 0x1, 0x8}}}}}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@beacon={{{}, {0x5}, @device_b}, 0xfffffffffffffffd, @default, 0x1001, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @val={0x5, 0x3, {0x5, 0xdd}}, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @void, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfa}}, @val={0x76, 0x6, {0x1, 0x9, 0x25, 0xe}}}, 0x4f) r7 = socket$nl_generic(0x10, 0x3, 0x10) write$FUSE_LK(0xffffffffffffffff, &(0x7f00000004c0)={0x28, 0x0, 0x0, {{0x3, 0xcbd7}}}, 0x28) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r9) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)={0x4c, r10, 0x1, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x279}], @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x400, {0x0, 0xfff, 0x10, 0xc4f}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000815}, 0x850) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x68, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x8c0}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x38, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x6}, @IFLA_MACSEC_SCI={0xc, 0x1, 0x73a6}, @IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x7}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x2}, @IFLA_MACSEC_ENCRYPT={0x5, 0x7, 0x7f}]}}}]}, 0x68}}, 0x0) 3.701334358s ago: executing program 3 (id=7168): openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2002, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001000/0x1000)=nil}) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x1fe, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x400000000000009, 0x7ffc, 0x80000001, 0x800000010000, 0x4, 0x4002004c2, 0x0, 0x654, 0x0, 0x3ffffc, 0xfffffffffffffffd, 0x7fffffff, 0x20000000009, 0xffff, 0xfffffffffffffff7], 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000380)) 3.631721009s ago: executing program 6 (id=7169): syz_open_dev$video4linux(&(0x7f0000000380), 0x2, 0x20) r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)={{0x12, 0x1, 0x300, 0x0, 0x1f, 0x66, 0x8, 0x58f, 0x6610, 0x4805, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x95, 0x70, 0x81, [{{0x9, 0x4, 0x0, 0x81, 0x0, 0xff, 0xff, 0xff, 0x2}}]}}]}}, &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000100", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB="000000488316d4038263cb0900000000000000000000000100"/35], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r1, 0xffffffffffffffff}, &(0x7f00000003c0), 0x0}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f00000000c0), 0xffffd6c0, r2}, 0x38) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setxattr$incfs_metadata(&(0x7f0000000300)='./file0\x00', &(0x7f0000000600), &(0x7f0000000640)="3e17f70697cb2604be801e1bb4aa79643931920b24d26a7d53452fb964ef26e6648df06a82931e8ef58a6f20790197a551433ec98cb0968195b0e6a398a1fc4597d29aefeca64d620e5423f6a423a7af50f4da4c1b340da4c58dddfe5de872b7357d7864e59a03462a164d10cabe6560026b2307e4350b943565c51b5c3d53a819", 0x81, 0x2) sendto$inet6(r4, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000080)='vegas', 0x5) shutdown(r4, 0x1) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x0, 0x6000, 0x1, &(0x7f00000003c0)='t'}, {0x1, 0x3a01, 0x0, 0x0}], 0x2}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) r5 = socket(0x40000000002, 0x3, 0x6) setsockopt(r5, 0xff, 0x1, 0x0, 0x32) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000480)={&(0x7f0000000280)=[0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300), &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0], 0x1, 0x6, 0x0, 0x4}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f00000004c0)={&(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x0, &(0x7f0000000180), &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x3}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r8 = openat$kvm(0xffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0500f7bc6b270000f3ff0500000008000300", @ANYRES32=r9], 0x24}}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)={0xa4, r7, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "4c08ee3522"}, @NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "31540cd5a9cff9b6763d0d8d70"}, @NL80211_KEY_TYPE={0x8}]}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "874d3b98a1"}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x1}, 0x20004041) 3.408051682s ago: executing program 1 (id=7170): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x59, &(0x7f0000000040)=ANY=[@ANYBLOB="2072dc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r1, 0x0, 0x0, 0x7500) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) 3.275981255s ago: executing program 3 (id=7171): socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, 0x0, 0xa4000021) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffd) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r3 = gettid() r4 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r5, 0x707, 0x0) ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000080)={&(0x7f0000000000)=[{0x2b, 0x0, 0x0, 0x0}, {0x800, 0x1, 0x0, &(0x7f0000000280)}], 0x2}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r5, 0xd000943e, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r5, 0xd000943e, 0x0) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r6, 0xffffffffffffffff, 0x0) 1.869755339s ago: executing program 5 (id=7173): r0 = socket$kcm(0x2, 0xa, 0x2) r1 = epoll_create1(0x0) r2 = dup3(r0, r1, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000009000000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509feffffff00009500000000000510bf91000000000000b7020000010000008500000085040000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x1005, &(0x7f0000002840)=""/4101}, 0x94) 1.796004864s ago: executing program 1 (id=7174): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$rtc(0xffffffffffffff9c, 0x0, 0xe2803, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_WKALM_SET(r2, 0x4028700f, 0x0) close_range(r2, r2, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$radio(0x0, 0x2, 0x2) socket$l2tp6(0xa, 0x2, 0x73) ioctl$VIDIOC_S_TUNER(r4, 0x4054561e, &(0x7f0000000040)={0x0, "a055babd9b8c29abbdd772a44c5518bc1661222efc50f8f5555dcf4617da81d7", 0x5, 0x400, 0x3, 0x5, 0x2, 0x4, 0xfffffff9, 0x5}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x5700}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x6}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) 1.758372364s ago: executing program 5 (id=7175): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c02000019000100fcffffff10000000ffffffff000000000000000000000000ac1414bb00000000000000000300000000000000ffff20000a00800000", @ANYRES16=r0], 0x23c}}, 0x0) 1.653479353s ago: executing program 5 (id=7176): ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000000)=0x80000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x106, 0x3}}, 0x20) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x7, &(0x7f0000000140)=[{0xc, 0xb8, 0x1, 0x7}, {0x7, 0x3f, 0x2, 0x8}, {0xfffa, 0x6, 0x40}, {0xc0, 0x9, 0x80, 0x5}, {0x1, 0x8, 0x3, 0xfffff355}, {0x1, 0x73, 0xe, 0x800}, {0x7, 0x0, 0x8, 0x8}]}, 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xf3b, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r1, 0x40084149, &(0x7f0000000200)=0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r3, 0x110, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xd}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4881}, 0x40000c5) read(r0, &(0x7f0000000380)=""/4096, 0x1000) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001380), 0x2, 0x0) write$UHID_INPUT(r4, &(0x7f00000013c0)={0x8, {"d88ae495ebf0a8da1183e13e4484b2a49f1ff1d4db22f608eb949f37c1d053fdc92fc218ce3c4f7a3cef66470ad246efe1b1247adfaad7e931551872790f5df920dc4f5f6d4810bb95a808f309309679da65a3b244bb5b381106de300176865f990f85262c3b984dc0796588b0bc53082172e4ee953e75403e01b8b5cf87bdcb7bbd48747462863d16994f02f9b30ef03a702f491d83a85d0dd4fce56911a37e098ac66334d0f3dfa7ad914f6a8785f857b6dd1cebc52daad194140ae18574270f7bb19a4e8a7ed05bbfe1baa2e9e4a78d17c104e165df412d5c8a5e99363376d856feaf4e062a9c83d140c44cdbc472eff36a5669030f0debad516869e5be4ba593e772cbb881794e066dd2d555feda1de2171bc933b9775c8e66fccff68409f30cf4d5ac0f04fbc711d63cd34e97f1bc34294f17e246c9e9ef87dbf6d6d8d111826e49204af294669afeda326cc40d150cd3638140d4094bcc64321dcdf3c4bc966ff8e186512973b79714342a93e54c3f8a62d0fd464809bc6d4c9f77c637a2e5ef2fb9ccd3abdb062368598e64f2f8034936e34f6f3c9c1fe35b43601287350cb50fe2fd109c4eccc22a877c637b1ec901c3796deb29070f915610d843b40bbd21532470eb911c98a9fa9ee1706064b5582f87e889642148cfac7bd2cca78cbdac50d797065d264ae46c033701d29a3d43ca78e07fd78ff347ef2bc683c5516ac84a6340db85fde946dfd130879e31c09ca46b54b433a31e49bf0a53ffb04f3cc166c6dc583881e5106a93b71a5226fdf185f20678497c2a534204fc62764d9df8b15b273071ce2471204caf7bb4e95c3c56bd864e08631395f1ec063b9d97f9a1bf542a1ae68c2c0ba8b7cf7192e4ad6a4b1bd78f3cbe12ef58e487285c140e57599e207782376f03771ee666a8e8c75fcfda91b50500f3799c78b78884ce4862b77ff30a05e4a412ed8bd9d9ecedd9befaca3d3622a22dfdc3a00edbfc8ba4ef2dff12baaba36c97411263e16426f0acb7919ab02992d44d79825cadeb1dac2acd910e269ffd714bc85f89c20617bb07cad37ff5143123304d7da7b50a5c60a0789a6cc026842142b277b1beda7c2f87b41090ebac1a12f327654558971ae35bea2eea240ff385d9eca8effb8cc71141a3cba51e86940c43a9a0c72df2a824ac3f8b1da3fb1abcefa01dc86f5169b7f362b56a351b1e1f8ddb060bfb2048d0ce070f3fff9c0ed0e56a47ebe0597fae156bf30ea17774f228db9f3cd9659fd883175a1fd3574d944fc2a67c79e4913e5d6e3be5e96171be4bfa4ef7b8772a5711801acc261ba0fecdab093dc49d91a2ace4f753fc56d248d72fba7e9e96835dd2a0801b67a9da394232ed33f3273b1507c02b455ac36810b937b9d99b84491520658365458b30b53da607e64ea5ef67e20d1c014ac2bee1cc8e297211f813cdcaeac7e41c44e1f34db8cae122d4d35e241ae58595c7361577538aba65ca989d82ac24fb220845c40c9208d5a6bc4d7313e2d3b74e4658c23154be7596874a7361193bd20345d1797847e1a299c82fecee25200af433ef62ac1b66a08ec1bc320257a290f0320564ff5f0b8da92ce1e4743a5cc373a3ba5890f0be469b30964115dc484b47225c855cbc92b98eff63905d761ed2684f82a1d653be09f3c6828aefb8966b56b786e3df98a9c9aba1d466aece0668d5892e35f0bab245da5c973362010e12398982def18fff2c118244eea8ed780f5725bcc99227ba15900836926fa6e0a3c791336c88d81d2081844ba9e5faf7386a457eaa52b55e906a1dee511e610027072f67d1ce5767025efed1d2c79428fd07be71deb7edc6a5ddae78c38b232c9f313933cd578ab76c1f8bbb44541446d525b4dd923d8eeeb6c1c3697841a5f1f9574cb7a38a91dd817cae42513d359930e7356801c7f6ef96acf629d0648992e0317954321423cc257b0af044e612e78e3d0a45f88b64a56425c40f3ccea22481d36628934439dfbad36241d7e4e18267d2dc2fa02ffd83c0ac372410d0e994c1ce830c7141f41b2e5b5d7d75eca523cc8775d614bee5a3a4e9f372a26ebd0d0604e35a14a037a5939e5a0bad9e5510af89ae7baab991cbd891b15bc805030d4b67a5ba0b8b39a434fa21469401aa8cc90439507f66d6cfd698acdc5c29ffc71d540b434c555cf2222efbbf9a3616b5fd7dd9783e0189d60699e15ca47248b08fa6e1f8b411a521bacd19c38083b76986639949ed05106453f068a1dbaad87a8c61566a1a3945753d5cb12a4c855ea63bbb162e8331b403ee7a8f7b0d3c051ab574c829b5b991d7116b80544dea4a0f28a7678fcc859ede31ef14a873f00b0e0a9782ce518b943a4b217238231fa15a73c72b2859e703af76411dd6a3f120b485aca355a7e810a01d89dc231235f0f388f4bee5b98da894a9ef178f80cc8f3613fe8cd9d573c9734dd1cbd7e6dcca8080a9bf3ceb055f7e40c3359b2189e7a157d2e634d8664c4b59d8f541b83e24d6759be946905e4a4297fa7cac364d9816e3808b1c30170f9f7b776c128a2b30679ca78341340708a1cd7fc52f219b4428ef8600b76acd00b5e788ded00591ea5808b563ab8bdcccbbb1c204ac3226645a31189605d1c52330e6d73c1286d6a210e5d2e000bdd098d5df5a4a0349ad8685ad6a23e7fcdb99b662ec4b6143a264022174e6a7e0a38037b5bfe444e07116e94061db35e6563c0afdbdab59fd8837e034be74150ce07a4afb0e8aea79c8109ab1c07fceb3ebc4842c24846f14d88a509bba15a51d9ed7a74c14b2ac889cc8d1250248f0fadc5acd0fb4e05c7692b41e741d4385653a182e9811e108a689014b53e6d2538024e41951a3050d80030c4e7334018663d6ea0df790fc0512a2d3e5a5f9a85b88847a799ef478f298dc70649e58579fda16bab4896fea0e804838366c800298e16bac9b40278a73ce76abf4b29d02aa71fb98d94799e3a6d6099e36bfad6f6e37c48000b5d30999aeddb22d5f6a69166ba895f9c892b4993b869dc065f0162c5619c3ba03db19e4396063840387e261e985b19f504449f0d48b52f4a9026c9bb886c43a04cf8364c798db9d4dd9aac83af7ba8ffb655e8703d502c4418a298e4f5155b7a6ac39d670d76e4c56c8ee02ff67eeb2febb9f91ac19f240c563e3cb5fae76e912cd690097d2acf0788c91147698bb8cbd245c534d81a1beb5f7ec9510fa74644f0b49042748e474137f0e2c3a84d45a5b6f79a9fea0b791fb1689a96e74760796d3b40f3b03955cda63df61e830192368b684f8be271284632a322d13a48907855447d0eb4bc9b9e02cbced9d41e9ed5f75c3acfdb51803c698d1da11bd47f2b13cda9ce5fadf14d1a8f300cd810718fb327f3fe646f495aeea879a2e7b48117135a43fc46cee3967e8314a345eba903ac90a3b807d89520a033f4d2fea3b99282e144e81bee35aa90caef877854176fc097bb68a2bf20cb6e3df7c8e5d28a1673778e55da6e5e796218ae65fe7273511f1af8384f75d1cb779afebdd991e509f4a1de233101b14b4ab0ac46edfe62ca9f6114a72aebcec5154c2786bb3a3b849687d59dc8562d57d290cf9768b456f72d9f5c3cc38e29635924dc217ff09007fdfdf8e8188f1524c10bca748451bc21c49803cab03d4bb5e2253d93e42fd29d74812fb8b724586a1a7b098672cd22219665ded5aed971d9fb27f3d12825a3b91658243af09048b37c81e35b0fccb3e82ad41ed3eb8df840d79037c8547fba50c7324181b57ab92ee068a61b0e82fd2805b432587fda35ab9698113b5e0fafbb8c53cd9b22c713bef0daeb048c8c382320cd4ea571ff4a207197be5bcf885f74a05a22a943d59527720fa4b252457f1331cd0b46cfa664bd7ac4ee10022a22b112bd6e9e3e77b61a49adb98708f386e94e83af16e8604c5172146c34a3319ebfb2c5ad9e24d4b09c6fb1dfc7026439e1ea8f0812ede49a45fa6b85c4bcc42ec1cacb0669a3b85395e23954d2906b208bb1f718ba774c9b6b630dc1b56be2e2d908549170f57f34d47f037ca72f9cebb4d349c5f7c2c31fa7e8e3cc193db90222d636b85353e61aa9caedfb9c1e6ddb5aa0b0e80e4669bffa2c1728da92703611236bc7cf0d414b9e8eddbecac9f6b635b916ce23f2edb0ebd20349d063af0b527c72c2f7150b6838676571e549fce5a707b713a8eca3038d3c1e7c06e8fba75bf0ca9bae43734c64bfb194867c4108029c945887088d2083cfeba28c66d35c826d85b94205a34cd3408f68240bab3dcf41c6757666c398665e3e70b83ac28619da837bcb051e0aed2c519be488baa16f477e3e505d45902eda678ab5a98c7aad6968e4d2714c5dfc6ea8d1744720254decc2f345df8583cb20e0e72e648575152d902a59bc3887d61c1f44bfa3cead724a2cfbbc5cc4444a20a68a27d16b11823ca8d79e4df01ae248b88b34cd84b03fb222637bd18d5973ce971f6b9cae65c9589999009d5b9e7105e68bad3c4ea1faa93736880c58f73dc3bc71a2faac843ac6e8cf85585b57db56db89bc9d95c0a1b84b5861c086d563605b369a1afda5fbff3bf204392566701f2f698bc39ce3d2300fae773c4bb413f4f779f9062691df44ee161e01b1bc00ec7606b11f63fb5236afee292c3b4ee37b51cac633ab66ca231f51a84d8a72993139430d3462e5a6d71938edca4f4e8c74daad6b6ce82f41b96a178225f26d023e8f19dd0b18afac7a64afa478d5f9d8b14cc8d3ae69d1380b4b5131bd859fcd68ea77f011fb6eb3a8dcb702ba0889f9ea8853f7e1427e6047f7bb10811d60b40bf07d8c9c0b5cfc0134bbb572e836155dce7d3808ec568afab89c073435233bad1369afd6bd2a27b06154004d38b6f18ec7abe7802f27aa5f4aa83c07312d76314053913fe65157749ce09258680330cf22f4b775afb896d8709ebc57eb20a0516bf75507e65856ace74a386de92f8297380a0bfc09be174df7deabc877ea32f1b3b243efbc6c5ae6131218fbb2ad8e1426466a502ab667d4f996f3349473b648fd4704c319526e8136b83e4b4117beb7bd302c08ebced67162c77c5106b3fe4e196119ac64eacbd611f1200f56763cfdd10b70a057ab0d3223b6a547c5b93a682970c48edc39230e70b1c80555fbee0be992a2b2a805394714a7bc10c4e5b64b867cecb292a1c5ee86480866213c3b1b96b6171906b8b664f6172d01d0d494ce3f42b4682e3a335dfe0e6b9cc800541c9441ce254bd257c7dacb0038d50ed300d3775fb63da171c74af704f05b8b4e2ccb78350c51689e004c2b3e82735a4be94a67b24c25df7ac93bec7049a15eff3760c783f37dafa0f045e7e7840c6a257922e5364a9e04575e748feaf4cfb5bdff6356ace063f72343a5a86a64438df469ade2e3f020cc7ea33d6b677a09f7e4118f9751f2791541aa733af163b1c126de114903c8eccdfee61fe9f3c8152aa8e5c80267403e443fa9fc2ff2e1cb6762a2f4922ad4aba9e1ad104cd2e096a9349c22efb47fe5965c325028ff5287ff2d174ee6d705a84eec528002620b6f416a80f8e1d9c4d1d46b2ff6087dfad3337aba2563b13fb8b3231b049a9002fba995e18702e12e4966357ebf2fcbf12c85793e948463b9940f8b347eed7518c2cef96b54cb689224ade969826b8812510f974e9a580430595d79c2cc01ae16c888a81a668260ae92b0ca33554320a56ced0c02a110ae412d956012444635103afde8fd150a755572485391f6b0972c2245e6fe5304969331cb6bc0244", 0x1000}}, 0x1006) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002400), 0x210280, 0x0) ioctl$SNDCTL_TMR_TEMPO(r5, 0xc0045405, &(0x7f0000002440)=0xb9) syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r6, &(0x7f0000002540)={&(0x7f0000002480)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002500)={&(0x7f00000024c0)={0x18, 0x1401, 0x4, 0x70bd26, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x40080) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000002580), 0x200000) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r7, 0x40505330, &(0x7f00000025c0)={{0x2, 0x5}, {0xea, 0xf}, 0x8, 0x0, 0x13}) pipe2(&(0x7f0000002640)={0xffffffffffffffff, 0xffffffffffffffff}, 0x13d6baaea1c597d1) ioctl$KVM_GET_EMULATED_CPUID(r9, 0xc008ae09, &(0x7f0000002680)={0xa, 0x0, [{0x4, 0x8, 0x7, 0x4, 0x2, 0x5, 0xfffffe01}, {0x2, 0x9, 0x3, 0x6, 0x6, 0x800, 0x4}, {0xd, 0x7fffffff, 0x4, 0x4, 0x2ad, 0x80000001, 0x6}, {0x0, 0xe79, 0x6, 0x8, 0x5, 0x9, 0x7}, {0xc0000009, 0x3, 0x2, 0x5, 0x5, 0x49b6, 0xd}, {0x0, 0x1, 0x1, 0x3ff, 0x1, 0x7b7e, 0x16c}, {0x80000019, 0x4, 0x4, 0xfffffff2, 0xae, 0x7, 0x5}, {0xc0000000, 0x5, 0x3, 0x1000, 0x1, 0x8, 0x4}, {0x7, 0x10001, 0x6, 0x0, 0x6, 0xfffff801, 0x5}, {0x80000000, 0x2, 0x4, 0xffff0000, 0x92, 0x1, 0x3}]}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r9, 0xc08c5334, &(0x7f0000002840)={0x5, 0x6, 0x1, 'queue0\x00'}) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xb) prctl$PR_GET_SECCOMP(0x15) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002940), r2) sendmsg$IPVS_CMD_DEL_DEST(r8, &(0x7f0000002a40)={&(0x7f0000002900)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002a00)={&(0x7f0000002980)={0x64, r10, 0x20, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'batadv_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010102}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000810}, 0xc0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000002b00)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000002a80)="82f88305fbea7bf328d2d2a45282d2acfe0e8a9c3d3380f89edee5286909b372452ebca868dd781ea163475456971e4f88007e47ef5fbd4e2db3367977e3a5e0e72535558cc93b54530d97fb0535fda7833f30c516571984298e6b0fb45beb8f76effc7e5035f844f0ea3c50eba20a938e", 0x71}, 0x68) ioctl$SNDCTL_SEQ_CTRLRATE(r8, 0xc0045103, &(0x7f0000002b80)=0x1) prctl$PR_GET_SECCOMP(0x15) 1.394476359s ago: executing program 5 (id=7177): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) close(r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-des3_ede-asm\x00'}, 0x58) r2 = io_uring_setup(0x7375, &(0x7f0000000100)={0x0, 0x4be, 0x800, 0xa, 0x2c3}) write$nci(r0, &(0x7f0000000180)=@NCI_OP_NFCEE_DISCOVER_NTF={0x2, 0x0, 0x3, 0x0, 0x8, {0x4, 0xed, "a27c09f179fe6a8c45e035b5600bc85fd52be78f95042b18a5c180e12a25f1f633da0ba69af346b8942ae2acce655768fb08e9cdc61b4b198425657e20327773d71bdca6d4b7554ce02c3ab36b62b988d6cfe592265e625ea7918cf3064dd0f1aa326fda2e683b3bbc6215ce542ae6e77221fd84bcab9017d50369c1ab27cf1353b4453c1a87fbbebcc8a4395d33f082c74c67835daaf67ad6ff484629ed7948839c83697b75e3154e2148993857f1c9fbe83556e675"}}, 0xbb) r3 = socket$inet(0x2, 0x4, 0x73f1) r4 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key$user(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)="58964a8ec8ffa7dc0c4a1ad5aeea90d85abcd9516308a1ac53f9fefaa41b929a6400a5d757a2aec0baa92d65b9d49247fdb292ade9a5e6ab31cd76a74a8aac9122b7f793cb4010", 0x47, r4) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f00000003c0)={0x0, @adiantum, 0x0, @desc4}) r5 = fcntl$dupfd(r1, 0x0, r2) r6 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000400)='/proc/asound/card0/oss_mixer\x00', 0x40, 0x0) write$proc_mixer(r6, &(0x7f0000000440)=[{'SYNTH', @void}, {'RECLEV', @void}], 0xd) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r7 = accept4$packet(r5, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14, 0x0) r9 = dup3(r7, r1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000580)={@private0, 0x53, r8}) ioctl$VHOST_SET_FEATURES(r9, 0x4008af00, &(0x7f00000005c0)=0x4000000) ioctl$sock_inet6_SIOCSIFDSTADDR(r9, 0x8918, &(0x7f0000000600)={@mcast1, 0x11, r8}) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000640)={0x50, 0x2b01}) r10 = add_key$keyring(&(0x7f0000000680), &(0x7f00000006c0)={'syz', 0x1}, 0x0, 0x0, 0x0) keyctl$KEYCTL_MOVE(0x1e, r4, r4, r10, 0x0) rename(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='./file0\x00') syz_open_dev$vivid(&(0x7f0000000780), 0x3, 0x2) syz_io_uring_setup(0x7ae, &(0x7f00000007c0)={0x0, 0x86ed, 0x20000, 0x0, 0x14e, 0x0, r2}, &(0x7f0000000840), &(0x7f0000000880)) timer_create(0x0, &(0x7f0000000a00)={0x0, 0x5, 0x0, @thr={&(0x7f00000008c0)="66ccc9d11e3225232e8bb83f", &(0x7f0000000900)="946901213c46ebe258ecaf1fb555e3b3fbe5ebc89bfe62f8f3604be8a557ba0df125ab2a478bae66f13da4ca26ab487a2be125c6e12eb1014103c859a032b2859a9bd398f000798961a3427acb1c90419a74d2c13cb7590de38714e9a9fdfa3db99af1c9e1fe2c179c9779b35dfdd4f3b47baadf6afdd7d1b5f81d572724948880f6732aa1c76b72611a41bcbaec074c472c4294e50f8f2cb01fbf52e8fd72c78fb5e46297d941d58d2466e2e1d6c2516dc9ecdd38aab7f315605d94f37c2045f8967f9776361188eab1713e369de7db8c3d5a7a6915ea134136af0d1d"}}, &(0x7f0000000a40)=0x0) timer_settime(r11, 0x0, &(0x7f0000000a80)={{0x0, 0x3938700}, {0x77359400}}, 0x0) ioctl$TIOCGICOUNT(r5, 0x545d, 0x0) 991.937014ms ago: executing program 5 (id=7178): socket(0xa, 0x3, 0x3a) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="340277f2b053a3304b89f8a7a80b00db96f248dabd7fac3c2f9e2b99a67f20a1cd09c0c843e5635493bbfa23b72d98a0c37a3e5805f5e2ec75e9d98b09"], 0x20}, 0x1, 0x0, 0x0, 0x80000}, 0x40800) (async) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) syz_usb_connect(0x5, 0xe4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000017ffd340b1134200bbdf000000010902d200010000400009046a00067af4190009050f102000050801060c8b631b7507250102020700090501", @ANYRES32], 0x0) (async) write$binfmt_script(r3, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2) write$binfmt_elf64(r3, &(0x7f0000000200)=ANY=[], 0x1cb) (async) close(r3) (async) execveat$binfmt(0xffffffffffffff9c, r2, 0x0, 0x0, 0x0) (async) r4 = syz_open_dev$video(0x0, 0x1d24, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) (async) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f00000021c0)=[{0x2000000000000009, 0xffffffff, 0x1}], 0x1, 0xc2ff, 0x0, 0x0, 0x0, 0x76}) (async) r6 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) 825.627697ms ago: executing program 5 (id=7179): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r1, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000080)={@remote, r3}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x1, 0x4, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4840) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x0, &(0x7f0000000100)}) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x54c, 0x9cc, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x8, [{{0x9, 0x4, 0x0, 0xf7, 0x4, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xffed, 0x2a, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xca}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380), 0x1c0002, 0x0) write$vga_arbiter(r8, &(0x7f0000000180)=@other={'lock', ' ', 'mem'}, 0x9) write$vga_arbiter(r8, &(0x7f0000000500)=ANY=[@ANYBLOB="6465636f646573206e6f6e650016ebd79f667a37426fe5de48d72003dd693ca31d610e5148d90cf3233a8fb1ba483209b043807e441711901ac57596aaf0270db3d2ab0cbc36ce76e32473be2637cb"], 0xd) syz_usb_control_io(r7, &(0x7f0000000000)={0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="c951e3d107361200000721940977459b"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={0xffffffffffffffff, &(0x7f0000000780)}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) close_range(r6, 0xffffffffffffffff, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) modify_ldt$write(0x1, &(0x7f0000000340)={0x8, 0x20000000}, 0x10) socket(0x840000000002, 0x3, 0xff) 482.837141ms ago: executing program 4 (id=7180): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="090100001000010000009f1bd9bd000000000000000000000000000000000000e00000020000000000000000460100000000000000200004000020fc0c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="64010100000000000000000000000000000000002b000000e0000002000000000000000000000000ff03000000000000030000000000000000000000000000000000000000000000000000000400000002000000000000000000000000000000001a00080000000000000000020000000000000000000000000000000000000004000000000000000000800001000000fcffffff00000000000000000a"], 0x138}, 0x1, 0x0, 0x0, 0x24048021}, 0x0) 407.932994ms ago: executing program 6 (id=7181): socket(0x10, 0x3, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = open$dir(0x0, 0x8000, 0x65) renameat2(r2, 0x0, 0xffffffffffffffff, 0x0, 0x4) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) close(0xffffffffffffffff) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r3, 0xc06864b8, &(0x7f0000002140)={0x0, 0xae, 0x3ff, 0x30315559, 0x2, [], [0x0, 0x0, 0xfffffffe, 0x4], [], [0x8000000000000000, 0x0, 0x4000]}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') preadv(r4, &(0x7f0000000600)=[{&(0x7f0000000380)=""/116, 0x74}], 0x1, 0x82000001, 0xff) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r5, 0x8946, 0x0) close(0x3) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') preadv(r6, &(0x7f0000000600)=[{&(0x7f0000000380)=""/116, 0x74}], 0x1, 0x82000001, 0xff) r7 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x4c, r7, 0x200, 0x70bd25, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'team_slave_1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) 377.540363ms ago: executing program 1 (id=7182): sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="020e000010"], 0x80}}, 0x4814) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x229ffa1c4ce5369, 0x0) (fail_nth: 9) 321.837932ms ago: executing program 4 (id=7183): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)={{0x12, 0x1, 0x300, 0x0, 0x1f, 0x66, 0x8, 0x58f, 0x6610, 0x4805, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x95, 0x70, 0x81, [{{0x9, 0x4, 0x0, 0x81, 0x0, 0xff, 0xff, 0xff, 0x2}}]}}]}}, &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000045, 0x0, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x20, 0x6000, 0x1, &(0x7f00000003c0)='t'}, {0x1, 0x3a01, 0x0, 0x0}], 0x2}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) 0s ago: executing program 1 (id=7184): syz_emit_ethernet(0x5e, &(0x7f0000000180)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60f4a9f700282c00fe800000000000000000000000000000ff0200000000000000000000000040647fe211a36888c5b30001890090780000000000000000000000000000ffffac1414aaff020000000000000000000000000001"], 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$vim2m(0x0, 0x7, 0x2) socket$inet_sctp(0x2, 0x1, 0x84) mprotect(&(0x7f0000086000/0x1000)=nil, 0x1000, 0x3000001) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x4000000000001c2, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="2b010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/232, 0xe8}]}, 0x1f00) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) listen(r4, 0x20000) r6 = fsmount(r3, 0x0, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000140)=ANY=[], 0xe) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000080)='cubic', 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x2000006, @remote, 0x1}, 0x1c) socket$inet_sctp(0x2, 0x5, 0x84) unshare(0x2c020400) kernel console output (not intermixed with test programs): 2107.771151][T30598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2107.771172][T30598] RIP: 0033:0x7fb0e018f749 [ 2107.771189][T30598] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2107.771207][T30598] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2107.771229][T30598] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2107.771244][T30598] RDX: 0000200000000080 RSI: 0000000000003b85 RDI: 0000000000000003 [ 2107.771258][T30598] RBP: 00007fb0e10f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2107.771271][T30598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2107.771284][T30598] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2107.771317][T30598] [ 2107.773250][T30598] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2108.044625][T19695] usb 2-1: Using ep0 maxpacket: 8 [ 2108.052720][T19695] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2108.096785][T19695] usb 2-1: config 4 interface 0 has no altsetting 0 [ 2108.116178][T19695] usb 2-1: string descriptor 0 read error: -22 [ 2108.125818][T19695] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2108.171627][T19695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2108.265566][T19695] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2108.369225][T19695] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2108.410671][T30603] FAULT_INJECTION: forcing a failure. [ 2108.410671][T30603] name failslab, interval 1, probability 0, space 0, times 0 [ 2108.432356][T19695] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2108.476267][T19695] usb 2-1: media controller created [ 2108.491749][T30603] CPU: 1 UID: 0 PID: 30603 Comm: syz.4.6786 Not tainted syzkaller #0 PREEMPT(full) [ 2108.491777][T30603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2108.491791][T30603] Call Trace: [ 2108.491800][T30603] [ 2108.491811][T30603] dump_stack_lvl+0x189/0x250 [ 2108.491832][T30603] ? __pfx____ratelimit+0x10/0x10 [ 2108.491855][T30603] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2108.491877][T30603] ? __pfx__printk+0x10/0x10 [ 2108.491920][T30603] ? __pfx___might_resched+0x10/0x10 [ 2108.491940][T30603] ? fs_reclaim_acquire+0x7d/0x100 [ 2108.491967][T30603] should_fail_ex+0x414/0x560 [ 2108.491990][T30603] should_failslab+0xa8/0x100 [ 2108.492008][T30603] __kvmalloc_node_noprof+0x158/0x900 [ 2108.492024][T30603] ? __kmalloc_cache_noprof+0x3d5/0x6e0 [ 2108.492057][T30603] ? alloc_netdev_mqs+0xc89/0x11b0 [ 2108.492080][T30603] ? alloc_netdev_mqs+0xbf8/0x11b0 [ 2108.492107][T30603] alloc_netdev_mqs+0xc89/0x11b0 [ 2108.492134][T30603] rtnl_create_link+0x31f/0xcf0 [ 2108.492157][T30603] rtnl_newlink_create+0x25c/0xb00 [ 2108.492199][T30603] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 2108.492236][T30603] ? __pfx___mutex_lock+0x10/0x10 [ 2108.492263][T30603] ? full_name_hash+0x89/0xe0 [ 2108.492283][T30603] ? netdev_name_node_lookup+0x32/0x120 [ 2108.492304][T30603] rtnl_newlink+0x16e4/0x1c80 [ 2108.492327][T30603] ? netlink_deliver_tap+0x19c/0x1b0 [ 2108.492376][T30603] ? __pfx_rtnl_newlink+0x10/0x10 [ 2108.492445][T30603] ? kasan_quarantine_put+0xdd/0x220 [ 2108.492469][T30603] ? lockdep_hardirqs_on+0x98/0x140 [ 2108.492518][T30603] ? nlmon_xmit+0xb0/0x100 [ 2108.492538][T30603] ? kmem_cache_free+0x192/0x670 [ 2108.492581][T30603] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2108.492606][T30603] ? lockdep_hardirqs_on+0x98/0x140 [ 2108.492631][T30603] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2108.492669][T30603] ? __lock_acquire+0x6b6/0x2cf0 [ 2108.492705][T30603] ? __dev_queue_xmit+0x259/0x3b10 [ 2108.492725][T30603] ? __dev_queue_xmit+0x259/0x3b10 [ 2108.492747][T30603] ? __dev_queue_xmit+0x1d47/0x3b10 [ 2108.492767][T30603] ? kasan_save_track+0x3e/0x80 [ 2108.492798][T30603] ? __kasan_slab_alloc+0x6c/0x80 [ 2108.492818][T30603] ? kmem_cache_alloc_noprof+0x367/0x6e0 [ 2108.492882][T30603] ? __pfx_rtnl_newlink+0x10/0x10 [ 2108.492917][T30603] rtnetlink_rcv_msg+0x7cf/0xb70 [ 2108.492945][T30603] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2108.492976][T30603] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2108.493004][T30603] ? ref_tracker_free+0x63a/0x7d0 [ 2108.493033][T30603] ? __asan_memcpy+0x40/0x70 [ 2108.493058][T30603] ? __pfx_ref_tracker_free+0x10/0x10 [ 2108.493077][T30603] ? __skb_clone+0x63/0x7a0 [ 2108.493103][T30603] netlink_rcv_skb+0x208/0x470 [ 2108.493137][T30603] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2108.493169][T30603] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2108.493208][T30603] ? netlink_deliver_tap+0x2e/0x1b0 [ 2108.493237][T30603] netlink_unicast+0x82f/0x9e0 [ 2108.493276][T30603] ? __pfx_netlink_unicast+0x10/0x10 [ 2108.493308][T30603] ? netlink_sendmsg+0x642/0xb30 [ 2108.493338][T30603] ? skb_put+0x11b/0x210 [ 2108.493367][T30603] netlink_sendmsg+0x805/0xb30 [ 2108.493397][T30603] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2108.493448][T30603] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2108.493477][T30603] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2108.493497][T30603] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2108.493526][T30603] __sock_sendmsg+0x21c/0x270 [ 2108.493546][T30603] ____sys_sendmsg+0x505/0x820 [ 2108.493581][T30603] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2108.493631][T30603] ? import_iovec+0x74/0xa0 [ 2108.493656][T30603] ___sys_sendmsg+0x21f/0x2a0 [ 2108.493687][T30603] ? __pfx____sys_sendmsg+0x10/0x10 [ 2108.493715][T30603] ? rcu_read_lock_any_held+0xb3/0x120 [ 2108.493771][T30603] ? __fget_files+0x2a/0x420 [ 2108.493794][T30603] ? __fget_files+0x3a0/0x420 [ 2108.493825][T30603] __x64_sys_sendmsg+0x19b/0x260 [ 2108.493851][T30603] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2108.493889][T30603] ? __pfx_ksys_write+0x10/0x10 [ 2108.493932][T30603] ? do_syscall_64+0xbe/0xf80 [ 2108.493956][T30603] do_syscall_64+0xfa/0xf80 [ 2108.493975][T30603] ? lockdep_hardirqs_on+0x98/0x140 [ 2108.494006][T30603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2108.494028][T30603] ? clear_bhb_loop+0x60/0xb0 [ 2108.494057][T30603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2108.494078][T30603] RIP: 0033:0x7fb0e018f749 [ 2108.494097][T30603] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2108.494115][T30603] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2108.494137][T30603] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2108.494148][T30603] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2108.494157][T30603] RBP: 00007fb0e10f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2108.494166][T30603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2108.494175][T30603] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2108.494208][T30603] [ 2109.002856][T19695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2109.523497][T30608] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6787'. [ 2109.742847][T24503] xr_serial 4-1:127.171: xr_serial converter detected [ 2109.777832][T24503] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 2109.829265][T24503] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 2109.882431][T24503] usb 4-1: USB disconnect, device number 86 [ 2109.926728][T24503] xr_serial 4-1:127.171: device disconnected [ 2109.958050][T30618] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6791'. [ 2110.491701][T19695] zl10353_read_register: readreg error (reg=127, ret==0) [ 2110.676410][T19695] usb 2-1: USB disconnect, device number 77 [ 2111.161420][T30640] netlink: 388 bytes leftover after parsing attributes in process `syz.5.6796'. [ 2111.360088][T30646] FAULT_INJECTION: forcing a failure. [ 2111.360088][T30646] name failslab, interval 1, probability 0, space 0, times 0 [ 2111.384098][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 2111.384119][ T30] audit: type=1326 audit(1764711476.451:4778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30629 comm="syz.1.6794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2fb38f749 code=0x7ffc0000 [ 2111.412700][ C1] vkms_vblank_simulate: vblank timer overrun [ 2111.420946][T30646] CPU: 1 UID: 0 PID: 30646 Comm: syz.5.6799 Not tainted syzkaller #0 PREEMPT(full) [ 2111.420968][T30646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2111.420980][T30646] Call Trace: [ 2111.420988][T30646] [ 2111.420996][T30646] dump_stack_lvl+0x189/0x250 [ 2111.421021][T30646] ? __pfx____ratelimit+0x10/0x10 [ 2111.421049][T30646] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2111.421068][T30646] ? __pfx__printk+0x10/0x10 [ 2111.421098][T30646] ? __pfx___might_resched+0x10/0x10 [ 2111.421116][T30646] ? fs_reclaim_acquire+0x7d/0x100 [ 2111.421139][T30646] should_fail_ex+0x414/0x560 [ 2111.421184][T30646] should_failslab+0xa8/0x100 [ 2111.421207][T30646] __kvmalloc_node_noprof+0x158/0x900 [ 2111.421226][T30646] ? __kmalloc_cache_noprof+0x3d5/0x6e0 [ 2111.421255][T30646] ? alloc_netdev_mqs+0xc89/0x11b0 [ 2111.421274][T30646] ? alloc_netdev_mqs+0xbf8/0x11b0 [ 2111.421302][T30646] alloc_netdev_mqs+0xc89/0x11b0 [ 2111.421331][T30646] rtnl_create_link+0x31f/0xcf0 [ 2111.421361][T30646] rtnl_newlink_create+0x25c/0xb00 [ 2111.421405][T30646] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 2111.421439][T30646] ? __pfx___mutex_lock+0x10/0x10 [ 2111.421474][T30646] ? full_name_hash+0x89/0xe0 [ 2111.421494][T30646] ? netdev_name_node_lookup+0x32/0x120 [ 2111.421521][T30646] rtnl_newlink+0x16e4/0x1c80 [ 2111.421550][T30646] ? netlink_deliver_tap+0x19c/0x1b0 [ 2111.421590][T30646] ? __pfx_rtnl_newlink+0x10/0x10 [ 2111.421640][T30646] ? kasan_quarantine_put+0xdd/0x220 [ 2111.421669][T30646] ? lockdep_hardirqs_on+0x98/0x140 [ 2111.421705][T30646] ? nlmon_xmit+0xb0/0x100 [ 2111.421724][T30646] ? kmem_cache_free+0x192/0x670 [ 2111.421762][T30646] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2111.421791][T30646] ? lockdep_hardirqs_on+0x98/0x140 [ 2111.421822][T30646] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2111.421854][T30646] ? __lock_acquire+0x6b6/0x2cf0 [ 2111.421887][T30646] ? __dev_queue_xmit+0x259/0x3b10 [ 2111.421905][T30646] ? __dev_queue_xmit+0x259/0x3b10 [ 2111.421926][T30646] ? __dev_queue_xmit+0x1d47/0x3b10 [ 2111.421944][T30646] ? kasan_save_track+0x3e/0x80 [ 2111.421971][T30646] ? __kasan_slab_alloc+0x6c/0x80 [ 2111.421988][T30646] ? kmem_cache_alloc_noprof+0x367/0x6e0 [ 2111.422047][T30646] ? __pfx_rtnl_newlink+0x10/0x10 [ 2111.422074][T30646] rtnetlink_rcv_msg+0x7cf/0xb70 [ 2111.422105][T30646] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2111.422132][T30646] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2111.422157][T30646] ? ref_tracker_free+0x63a/0x7d0 [ 2111.422185][T30646] ? __asan_memcpy+0x40/0x70 [ 2111.422211][T30646] ? __pfx_ref_tracker_free+0x10/0x10 [ 2111.422236][T30646] ? __skb_clone+0x63/0x7a0 [ 2111.422264][T30646] netlink_rcv_skb+0x208/0x470 [ 2111.422295][T30646] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2111.422324][T30646] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2111.422362][T30646] ? netlink_deliver_tap+0x2e/0x1b0 [ 2111.422429][T30646] netlink_unicast+0x82f/0x9e0 [ 2111.422475][T30646] ? __pfx_netlink_unicast+0x10/0x10 [ 2111.422506][T30646] ? netlink_sendmsg+0x642/0xb30 [ 2111.422536][T30646] ? skb_put+0x11b/0x210 [ 2111.422570][T30646] netlink_sendmsg+0x805/0xb30 [ 2111.422610][T30646] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2111.422644][T30646] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2111.422671][T30646] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2111.422693][T30646] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2111.422726][T30646] __sock_sendmsg+0x21c/0x270 [ 2111.422755][T30646] ____sys_sendmsg+0x505/0x820 [ 2111.422794][T30646] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2111.422836][T30646] ? import_iovec+0x74/0xa0 [ 2111.422862][T30646] ___sys_sendmsg+0x21f/0x2a0 [ 2111.422895][T30646] ? __pfx____sys_sendmsg+0x10/0x10 [ 2111.422933][T30646] ? rcu_read_lock_any_held+0xb3/0x120 [ 2111.422985][T30646] ? __fget_files+0x2a/0x420 [ 2111.423009][T30646] ? __fget_files+0x3a0/0x420 [ 2111.423043][T30646] __x64_sys_sendmsg+0x19b/0x260 [ 2111.423079][T30646] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2111.423121][T30646] ? __pfx_ksys_write+0x10/0x10 [ 2111.423157][T30646] ? do_syscall_64+0xbe/0xf80 [ 2111.423181][T30646] do_syscall_64+0xfa/0xf80 [ 2111.423200][T30646] ? lockdep_hardirqs_on+0x98/0x140 [ 2111.423231][T30646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2111.423253][T30646] ? clear_bhb_loop+0x60/0xb0 [ 2111.423279][T30646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2111.423300][T30646] RIP: 0033:0x7f861458f749 [ 2111.423319][T30646] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2111.423337][T30646] RSP: 002b:00007f861544a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2111.423359][T30646] RAX: ffffffffffffffda RBX: 00007f86147e5fa0 RCX: 00007f861458f749 [ 2111.423376][T30646] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2111.423389][T30646] RBP: 00007f861544a090 R08: 0000000000000000 R09: 0000000000000000 [ 2111.423402][T30646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2111.423414][T30646] R13: 00007f86147e6038 R14: 00007f86147e5fa0 R15: 00007f861490fa28 [ 2111.423448][T30646] [ 2111.906397][ C1] vkms_vblank_simulate: vblank timer overrun [ 2111.920534][ T30] audit: type=1326 audit(1764711476.451:4779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30629 comm="syz.1.6794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc2fb38f749 code=0x7ffc0000 [ 2111.943051][ C1] vkms_vblank_simulate: vblank timer overrun [ 2112.408710][T30657] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6802'. [ 2112.418636][T19690] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 2112.578559][T19690] usb 6-1: Using ep0 maxpacket: 8 [ 2112.684780][T19690] usb 6-1: config 127 has an invalid interface number: 171 but max is 1 [ 2112.704175][T19690] usb 6-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 2112.727377][T19690] usb 6-1: config 127 has no interface number 1 [ 2112.748756][T19690] usb 6-1: config 127 interface 171 has no altsetting 0 [ 2112.772241][T30663] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6803'. [ 2112.799074][T30664] netlink: 'syz.3.6804': attribute type 1 has an invalid length. [ 2112.810651][T19690] usb 6-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 2112.852426][T19690] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2112.860900][T19690] usb 6-1: Product: syz [ 2112.865080][T19690] usb 6-1: Manufacturer: syz [ 2112.870080][T19690] usb 6-1: SerialNumber: syz [ 2113.035035][T30664] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2113.211576][T15480] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 2113.368595][T15480] usb 5-1: Using ep0 maxpacket: 16 [ 2113.376050][T15480] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 2113.385734][T15480] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2113.414732][T15480] usb 5-1: config 0 has no interface number 0 [ 2113.422476][T15480] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2113.438264][T15480] usb 5-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 2113.450065][T15480] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2113.470370][T15480] usb 5-1: config 0 descriptor?? [ 2113.490115][T15480] usbhid 5-1:0.1: couldn't find an input interrupt endpoint [ 2114.430619][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2114.714011][T30685] netlink: 72 bytes leftover after parsing attributes in process `syz.6.6807'. [ 2115.368320][T30691] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2115.775353][T30697] FAULT_INJECTION: forcing a failure. [ 2115.775353][T30697] name failslab, interval 1, probability 0, space 0, times 0 [ 2115.860554][T19690] xr_serial 6-1:127.171: xr_serial converter detected [ 2115.871636][T30697] CPU: 1 UID: 0 PID: 30697 Comm: syz.1.6812 Not tainted syzkaller #0 PREEMPT(full) [ 2115.871662][T30697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2115.871675][T30697] Call Trace: [ 2115.871684][T30697] [ 2115.871692][T30697] dump_stack_lvl+0x189/0x250 [ 2115.871719][T30697] ? __pfx____ratelimit+0x10/0x10 [ 2115.871748][T30697] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2115.871770][T30697] ? __pfx__printk+0x10/0x10 [ 2115.871801][T30697] ? __pfx___might_resched+0x10/0x10 [ 2115.871826][T30697] should_fail_ex+0x414/0x560 [ 2115.871856][T30697] should_failslab+0xa8/0x100 [ 2115.871879][T30697] kmem_cache_alloc_node_noprof+0x77/0x700 [ 2115.871908][T30697] ? __alloc_skb+0x112/0x2d0 [ 2115.871942][T30697] __alloc_skb+0x112/0x2d0 [ 2115.871972][T30697] netlink_ack+0x146/0xa50 [ 2115.871999][T30697] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2115.872024][T30697] ? ref_tracker_free+0x63a/0x7d0 [ 2115.872052][T30697] ? __asan_memcpy+0x40/0x70 [ 2115.872078][T30697] ? __pfx_ref_tracker_free+0x10/0x10 [ 2115.872114][T30697] netlink_rcv_skb+0x28c/0x470 [ 2115.872143][T30697] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2115.872171][T30697] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2115.872209][T30697] ? netlink_deliver_tap+0x2e/0x1b0 [ 2115.872245][T30697] netlink_unicast+0x82f/0x9e0 [ 2115.872286][T30697] ? __pfx_netlink_unicast+0x10/0x10 [ 2115.872315][T30697] ? netlink_sendmsg+0x642/0xb30 [ 2115.872342][T30697] ? skb_put+0x11b/0x210 [ 2115.872374][T30697] netlink_sendmsg+0x805/0xb30 [ 2115.872411][T30697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2115.872442][T30697] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2115.872468][T30697] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2115.872488][T30697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2115.872516][T30697] __sock_sendmsg+0x21c/0x270 [ 2115.872543][T30697] ____sys_sendmsg+0x505/0x820 [ 2115.872577][T30697] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2115.872614][T30697] ? import_iovec+0x74/0xa0 [ 2115.872637][T30697] ___sys_sendmsg+0x21f/0x2a0 [ 2115.872672][T30697] ? __pfx____sys_sendmsg+0x10/0x10 [ 2115.872709][T30697] ? rcu_read_lock_any_held+0xb3/0x120 [ 2115.872755][T30697] ? __fget_files+0x2a/0x420 [ 2115.872777][T30697] ? __fget_files+0x3a0/0x420 [ 2115.872809][T30697] __x64_sys_sendmsg+0x19b/0x260 [ 2115.872842][T30697] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2115.872882][T30697] ? __pfx_ksys_write+0x10/0x10 [ 2115.872914][T30697] ? do_syscall_64+0xbe/0xf80 [ 2115.872936][T30697] do_syscall_64+0xfa/0xf80 [ 2115.872954][T30697] ? lockdep_hardirqs_on+0x98/0x140 [ 2115.872983][T30697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2115.873004][T30697] ? clear_bhb_loop+0x60/0xb0 [ 2115.873027][T30697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2115.873047][T30697] RIP: 0033:0x7fc2fb38f749 [ 2115.873064][T30697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2115.873083][T30697] RSP: 002b:00007fc2fc2a9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2115.873104][T30697] RAX: ffffffffffffffda RBX: 00007fc2fb5e5fa0 RCX: 00007fc2fb38f749 [ 2115.873119][T30697] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2115.873132][T30697] RBP: 00007fc2fc2a9090 R08: 0000000000000000 R09: 0000000000000000 [ 2115.873144][T30697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2115.873156][T30697] R13: 00007fc2fb5e6038 R14: 00007fc2fb5e5fa0 R15: 00007fc2fb70fa28 [ 2115.873188][T30697] [ 2116.208025][ C1] vkms_vblank_simulate: vblank timer overrun [ 2116.391292][T19690] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 2116.397735][T19690] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 2116.415876][T19690] usb 6-1: USB disconnect, device number 72 [ 2116.423205][T19690] xr_serial 6-1:127.171: device disconnected [ 2116.448230][T29045] usb 5-1: USB disconnect, device number 94 [ 2116.558598][T25884] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 2116.707132][T30699] netlink: 80 bytes leftover after parsing attributes in process `syz.5.6813'. [ 2116.770382][T25884] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2116.811911][T25884] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2116.845385][T25884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2116.865668][T30707] IPVS: set_ctl: invalid protocol: 51 10.1.1.2:20001 [ 2116.895905][T25884] usb 4-1: Product: syz [ 2116.906045][T25884] usb 4-1: Manufacturer: syz [ 2116.913787][T25884] usb 4-1: SerialNumber: syz [ 2118.011892][T25884] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 2118.035345][T25884] cdc_ncm 4-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 2118.070744][T25884] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 2118.236923][T30696] binder: 30692:30696 ioctl c018620c 2000000002c0 returned -1 [ 2119.358730][T29045] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 2119.964593][T30741] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2120.558574][T29045] usb 5-1: Using ep0 maxpacket: 8 [ 2120.581046][T30748] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6828'. [ 2120.717226][T29045] usb 5-1: config 127 has an invalid interface number: 171 but max is 1 [ 2120.786870][T29045] usb 5-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 2120.812933][T29045] usb 5-1: config 127 has no interface number 1 [ 2120.828049][T29045] usb 5-1: config 127 interface 171 has no altsetting 0 [ 2120.925232][T29045] usb 5-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 2120.944888][T29045] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2120.964950][T29045] usb 5-1: Product: syz [ 2120.978697][T29045] usb 5-1: Manufacturer: syz [ 2120.983324][T29045] usb 5-1: SerialNumber: syz [ 2121.275944][T25884] cdc_ncm 4-1:1.0: setting tx_max = 88 [ 2121.346208][T25884] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 2121.423820][T25884] usb 4-1: USB disconnect, device number 87 [ 2121.447577][T25884] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 2122.199412][T30760] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2122.269413][T19696] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 2122.508712][T19696] usb 2-1: Using ep0 maxpacket: 16 [ 2122.557514][T19696] usb 2-1: config 0 has no interfaces? [ 2122.582970][T19696] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2122.607861][T19696] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2122.627362][T19696] usb 2-1: Manufacturer: syz [ 2122.648302][T19696] usb 2-1: config 0 descriptor?? [ 2122.852639][T29045] xr_serial 5-1:127.171: xr_serial converter detected [ 2122.881446][T29045] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 2122.896830][T29045] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 2122.937049][T29045] usb 5-1: USB disconnect, device number 95 [ 2122.956677][T29045] xr_serial 5-1:127.171: device disconnected [ 2123.754627][T30785] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6838'. [ 2123.794566][T30785] netlink: 32 bytes leftover after parsing attributes in process `syz.6.6838'. [ 2123.887499][T30785] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2124.408591][T30609] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 2124.577437][T30609] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2124.598614][T30609] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2124.614471][T30609] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2124.624953][T30609] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 2124.636689][T30609] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 2124.650778][T30609] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2124.668356][T30609] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2124.695486][T30609] usb 4-1: Product: syz [ 2124.706190][T30609] usb 4-1: Manufacturer: syz [ 2124.721817][T30609] cdc_wdm 4-1:1.0: skipping garbage [ 2124.746845][T30609] cdc_wdm 4-1:1.0: skipping garbage [ 2124.797635][T30609] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 2124.807456][T30609] cdc_wdm 4-1:1.0: Unknown control protocol [ 2124.938788][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 2124.938973][T30609] usb 4-1: USB disconnect, device number 88 [ 2124.945755][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 2124.957394][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 2125.064266][T25884] usb 2-1: USB disconnect, device number 78 [ 2125.468829][T30609] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 2125.652379][T30609] usb 4-1: config 1 interface 0 altsetting 15 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 2125.664087][T30813] tipc: Started in network mode [ 2125.691367][T30813] tipc: Node identity de0d5098d864, cluster identity 4711 [ 2125.723461][T30609] usb 4-1: config 1 interface 0 has no altsetting 0 [ 2125.742346][T30813] tipc: Enabled bearer , priority 0 [ 2125.768810][T30814] syzkaller0: entered promiscuous mode [ 2125.782829][T30609] usb 4-1: New USB device found, idVendor=046d, idProduct=c53f, bcdDevice= 0.40 [ 2125.820492][T30609] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2125.849729][T30609] usb 4-1: Product: ~餵ᇦ馇儡릖䌶ꃛꖗ❌말飁窔㫩圊ᯱԧ䊚弃᪵謦궲哀ຮ軤鳍鐼厤 [ 2125.885019][T30814] syzkaller0: entered allmulticast mode [ 2125.911265][T30609] usb 4-1: Manufacturer: ᐊ [ 2125.938561][T30609] usb 4-1: SerialNumber: syz [ 2126.013071][T30816] tipc: Resetting bearer [ 2126.288567][T25884] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 2126.371792][T30812] tipc: Resetting bearer [ 2126.415005][T30609] usbhid 4-1:1.0: can't add hid device: -71 [ 2126.478724][T30609] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 2126.512881][T30812] tipc: Disabling bearer [ 2126.531112][T25884] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2126.544978][T25884] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2126.557593][T30609] usb 4-1: USB disconnect, device number 89 [ 2126.629864][T25884] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2126.693537][T25884] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2126.756521][T25884] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2126.852704][T25884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2126.966767][T25884] usb 6-1: config 0 descriptor?? [ 2127.316313][T30833] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2127.720400][T30837] syzkaller0: entered promiscuous mode [ 2127.756746][T30837] syzkaller0: entered allmulticast mode [ 2127.780576][T30838] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6850'. [ 2127.855861][T30838] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6850'. [ 2128.829800][T25884] usbhid 6-1:0.0: can't add hid device: -71 [ 2128.871027][T25884] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2128.908919][T30609] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 2129.001688][T25884] usb 6-1: USB disconnect, device number 73 [ 2129.421380][T30852] netlink: 388 bytes leftover after parsing attributes in process `syz.5.6853'. [ 2129.610536][T30609] usb 5-1: device descriptor read/64, error -71 [ 2129.889361][T30609] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 2130.057893][T30609] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 2130.067038][T30865] syzkaller0: entered promiscuous mode [ 2130.073187][T30865] syzkaller0: entered allmulticast mode [ 2130.079707][T30609] usb 5-1: config 0 has no interface number 0 [ 2130.091154][T30609] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 2130.100923][T30609] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2130.109698][T30609] usb 5-1: Product: syz [ 2130.114107][T30609] usb 5-1: Manufacturer: syz [ 2130.123388][T30609] usb 5-1: SerialNumber: syz [ 2130.131507][T30866] netlink: 64 bytes leftover after parsing attributes in process `syz.6.6858'. [ 2130.142707][T30609] usb 5-1: config 0 descriptor?? [ 2130.354004][T30609] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 2130.379699][T30609] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2130.409424][T30609] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 2130.417705][T30609] usb 5-1: media controller created [ 2130.553183][T30609] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2130.632942][T30609] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 2130.743617][T30609] usb 5-1: USB disconnect, device number 97 [ 2130.923237][T30890] netlink: 25 bytes leftover after parsing attributes in process `syz.3.6866'. [ 2130.935082][T30888] FAULT_INJECTION: forcing a failure. [ 2130.935082][T30888] name failslab, interval 1, probability 0, space 0, times 0 [ 2130.974327][T30888] CPU: 1 UID: 0 PID: 30888 Comm: syz.1.6865 Not tainted syzkaller #0 PREEMPT(full) [ 2130.974358][T30888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2130.974373][T30888] Call Trace: [ 2130.974383][T30888] [ 2130.974392][T30888] dump_stack_lvl+0x189/0x250 [ 2130.974421][T30888] ? __pfx____ratelimit+0x10/0x10 [ 2130.974453][T30888] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2130.974476][T30888] ? __pfx__printk+0x10/0x10 [ 2130.974508][T30888] ? __pfx___might_resched+0x10/0x10 [ 2130.974530][T30888] ? fs_reclaim_acquire+0x7d/0x100 [ 2130.974556][T30888] should_fail_ex+0x414/0x560 [ 2130.974589][T30888] should_failslab+0xa8/0x100 [ 2130.974613][T30888] __kmalloc_noprof+0xcb/0x7e0 [ 2130.974644][T30888] ? io_cache_alloc_new+0x40/0x100 [ 2130.974675][T30888] ? percpu_ref_get_many+0x18c/0x1e0 [ 2130.974702][T30888] io_cache_alloc_new+0x40/0x100 [ 2130.974736][T30888] io_msg_alloc_async+0x1b2/0x2d0 [ 2130.974770][T30888] io_send_zc_prep+0x42f/0xa10 [ 2130.974812][T30888] io_submit_sqes+0x935/0x1e40 [ 2130.974867][T30888] __se_sys_io_uring_enter+0x2df/0x2b00 [ 2130.974912][T30888] ? ksys_write+0x1cb/0x250 [ 2130.974964][T30888] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 2130.974985][T30888] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 2130.975005][T30888] ? __pfx_vfs_write+0x10/0x10 [ 2130.975036][T30888] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2130.975060][T30888] ? __fget_files+0x3a0/0x420 [ 2130.975090][T30888] ? fput+0xa0/0xd0 [ 2130.975114][T30888] ? ksys_write+0x22a/0x250 [ 2130.975145][T30888] ? __pfx_ksys_write+0x10/0x10 [ 2130.975179][T30888] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 2130.975205][T30888] do_syscall_64+0xfa/0xf80 [ 2130.975222][T30888] ? lockdep_hardirqs_on+0x98/0x140 [ 2130.975251][T30888] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2130.975271][T30888] ? clear_bhb_loop+0x60/0xb0 [ 2130.975295][T30888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2130.975315][T30888] RIP: 0033:0x7fc2fb38f749 [ 2130.975333][T30888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2130.975351][T30888] RSP: 002b:00007fc2fc2a9038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 2130.975373][T30888] RAX: ffffffffffffffda RBX: 00007fc2fb5e5fa0 RCX: 00007fc2fb38f749 [ 2130.975388][T30888] RDX: 0000000000000004 RSI: 000000000000749d RDI: 0000000000000003 [ 2130.975401][T30888] RBP: 00007fc2fc2a9090 R08: 0000000000000000 R09: 0000000000000000 [ 2130.975414][T30888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2130.975426][T30888] R13: 00007fc2fb5e6038 R14: 00007fc2fb5e5fa0 R15: 00007fc2fb70fa28 [ 2130.975458][T30888] [ 2131.556926][T30905] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6869'. [ 2131.574239][T30894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2131.660101][T30894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2131.729200][T15480] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 2131.825771][T30892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2132.056013][T30894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2132.074884][T30892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2132.144410][T30894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2132.273725][T30894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2132.318285][T30919] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6872'. [ 2132.372184][T30894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2133.849366][T30939] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2133.862398][T30939] FAULT_INJECTION: forcing a failure. [ 2133.862398][T30939] name fail_iommufd, interval 1, probability 0, space 0, times 1 [ 2133.879821][T30939] CPU: 0 UID: 0 PID: 30939 Comm: syz.4.6878 Not tainted syzkaller #0 PREEMPT(full) [ 2133.879849][T30939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2133.879863][T30939] Call Trace: [ 2133.879871][T30939] [ 2133.879880][T30939] dump_stack_lvl+0x189/0x250 [ 2133.879907][T30939] ? __pfx____ratelimit+0x10/0x10 [ 2133.879937][T30939] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2133.879959][T30939] ? __pfx__printk+0x10/0x10 [ 2133.879988][T30939] ? iopt_area_fill_domains+0x1a9/0x7e0 [ 2133.880019][T30939] ? __pfx___mutex_lock+0x10/0x10 [ 2133.880041][T30939] should_fail_ex+0x414/0x560 [ 2133.880072][T30939] pfn_reader_first+0x27a/0xa80 [ 2133.880103][T30939] iopt_area_fill_domains+0x20e/0x7e0 [ 2133.880138][T30939] ? __pfx_iopt_area_fill_domains+0x10/0x10 [ 2133.880198][T30939] ? iopt_map_pages+0xa1c/0xd80 [ 2133.880234][T30939] ? down_read+0x274/0x2e0 [ 2133.880259][T30939] iopt_map_pages+0xa89/0xd80 [ 2133.880300][T30939] ? __pfx_iopt_map_pages+0x10/0x10 [ 2133.880330][T30939] ? do_syscall_64+0xfa/0xf80 [ 2133.880388][T30939] iopt_map_common+0x2bb/0x4f0 [ 2133.880434][T30939] ? __pfx_iopt_map_common+0x10/0x10 [ 2133.880510][T30939] iopt_map_user_pages+0xbc/0xd0 [ 2133.880548][T30939] iommufd_ioas_map+0x392/0x4c0 [ 2133.880582][T30939] ? __pfx_iommufd_ioas_map+0x10/0x10 [ 2133.880615][T30939] iommufd_fops_ioctl+0x45e/0x580 [ 2133.880646][T30939] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 2133.880686][T30939] ? __fget_files+0x3a0/0x420 [ 2133.880708][T30939] ? __fget_files+0x2a/0x420 [ 2133.880741][T30939] ? bpf_lsm_file_ioctl+0x9/0x20 [ 2133.880766][T30939] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 2133.880791][T30939] __se_sys_ioctl+0xfc/0x170 [ 2133.880824][T30939] do_syscall_64+0xfa/0xf80 [ 2133.880843][T30939] ? lockdep_hardirqs_on+0x98/0x140 [ 2133.880875][T30939] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2133.880896][T30939] ? clear_bhb_loop+0x60/0xb0 [ 2133.880922][T30939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2133.880943][T30939] RIP: 0033:0x7fb0e018f749 [ 2133.880963][T30939] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2133.880982][T30939] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2133.881004][T30939] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2133.881020][T30939] RDX: 0000200000000080 RSI: 0000000000003b85 RDI: 0000000000000003 [ 2133.881034][T30939] RBP: 00007fb0e10f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2133.881047][T30939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2133.881060][T30939] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2133.881093][T30939] [ 2134.150156][ C0] vkms_vblank_simulate: vblank timer overrun [ 2134.535091][T30948] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2135.078663][T27558] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 2135.455008][T30970] loop6: detected capacity change from 0 to 524288000 [ 2135.493819][T30969] syzkaller1: entered promiscuous mode [ 2135.565611][T30969] syzkaller1: entered allmulticast mode [ 2135.636747][T30973] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6887'. [ 2136.264783][T30975] netlink: 'syz.3.6888': attribute type 13 has an invalid length. [ 2136.318555][T15480] usb 2-1: new full-speed USB device number 79 using dummy_hcd [ 2136.421416][T30975] gretap0: refused to change device tx_queue_len [ 2136.450900][T30975] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2136.547358][T30986] netlink: 140 bytes leftover after parsing attributes in process `syz.5.6891'. [ 2136.590427][T15480] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2136.677784][T15480] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 2136.841072][T15480] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 13155, setting to 64 [ 2136.858117][T15480] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 2136.945213][T15480] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 2136.988947][T15480] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2137.033889][T15480] usb 2-1: Product: syz [ 2137.063406][T15480] usb 2-1: Manufacturer: syz [ 2137.068048][T15480] usb 2-1: SerialNumber: syz [ 2137.118771][T29045] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 2137.137446][T15480] usb 2-1: config 0 descriptor?? [ 2137.186127][T30982] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 2137.309480][T29045] usb 6-1: Using ep0 maxpacket: 16 [ 2137.317549][T29045] usb 6-1: config 149 has an invalid interface number: 17 but max is 0 [ 2137.387361][T29045] usb 6-1: config 149 has no interface number 0 [ 2137.424516][T29045] usb 6-1: config 149 interface 17 has no altsetting 0 [ 2137.469129][T15480] rc_core: IR keymap rc-imon-rsc not found [ 2137.483156][T29045] usb 6-1: New USB device found, idVendor=0d9f, idProduct=0002, bcdDevice=65.f4 [ 2137.496966][T15480] Registered IR keymap rc-empty [ 2137.508123][T31000] FAULT_INJECTION: forcing a failure. [ 2137.508123][T31000] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2137.527080][T29045] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2137.549587][T30982] usb usb8: usbfs: process 30982 (syz.1.6890) did not claim interface 3 before use [ 2137.560800][T15480] rc rc0: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 2137.570257][T29045] usb 6-1: Product: syz [ 2137.585785][T31000] CPU: 1 UID: 0 PID: 31000 Comm: syz.6.6894 Not tainted syzkaller #0 PREEMPT(full) [ 2137.585812][T31000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2137.585823][T31000] Call Trace: [ 2137.585829][T31000] [ 2137.585835][T31000] dump_stack_lvl+0x189/0x250 [ 2137.585854][T31000] ? __pfx____ratelimit+0x10/0x10 [ 2137.585875][T31000] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2137.585890][T31000] ? __pfx__printk+0x10/0x10 [ 2137.585909][T31000] ? __might_fault+0xb0/0x130 [ 2137.585938][T31000] should_fail_ex+0x414/0x560 [ 2137.585959][T31000] _copy_from_iter+0x1de/0x1790 [ 2137.585984][T31000] ? rcu_is_watching+0x15/0xb0 [ 2137.586003][T31000] ? __pfx__copy_from_iter+0x10/0x10 [ 2137.586024][T31000] ? __build_skb_around+0x22d/0x3c0 [ 2137.586047][T31000] ? skb_put+0x11b/0x210 [ 2137.586069][T31000] pfkey_sendmsg+0x230/0x1090 [ 2137.586092][T31000] ? __pfx___might_resched+0x10/0x10 [ 2137.586110][T31000] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2137.586129][T31000] ? aa_sk_perm+0x160/0x920 [ 2137.586146][T31000] ? aa_sk_perm+0x7f0/0x920 [ 2137.586162][T31000] ? __lock_acquire+0x6b6/0x2cf0 [ 2137.586183][T31000] ? __pfx_aa_sk_perm+0x10/0x10 [ 2137.586196][T31000] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 2137.586225][T31000] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2137.586243][T31000] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2137.586258][T31000] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2137.586276][T31000] __sock_sendmsg+0x21c/0x270 [ 2137.586295][T31000] ____sys_sendmsg+0x52d/0x820 [ 2137.586320][T31000] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2137.586347][T31000] ? import_iovec+0x74/0xa0 [ 2137.586363][T31000] ___sys_sendmsg+0x21f/0x2a0 [ 2137.586389][T31000] ? __pfx____sys_sendmsg+0x10/0x10 [ 2137.586436][T31000] ? __fget_files+0x2a/0x420 [ 2137.586451][T31000] ? __fget_files+0x3a0/0x420 [ 2137.586475][T31000] __sys_sendmmsg+0x227/0x430 [ 2137.586501][T31000] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2137.586528][T31000] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2137.586554][T31000] ? ksys_write+0x22a/0x250 [ 2137.586577][T31000] ? __pfx_ksys_write+0x10/0x10 [ 2137.586601][T31000] __x64_sys_sendmmsg+0xa0/0xc0 [ 2137.586624][T31000] do_syscall_64+0xfa/0xf80 [ 2137.586636][T31000] ? lockdep_hardirqs_on+0x98/0x140 [ 2137.586657][T31000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2137.586671][T31000] ? clear_bhb_loop+0x60/0xb0 [ 2137.586687][T31000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2137.586701][T31000] RIP: 0033:0x7fb67fd8f749 [ 2137.586713][T31000] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2137.586724][T31000] RSP: 002b:00007fb680bdb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2137.586739][T31000] RAX: ffffffffffffffda RBX: 00007fb67ffe5fa0 RCX: 00007fb67fd8f749 [ 2137.586749][T31000] RDX: 0229ffa1c4ce5369 RSI: 0000200000000180 RDI: 0000000000000003 [ 2137.586758][T31000] RBP: 00007fb680bdb090 R08: 0000000000000000 R09: 0000000000000000 [ 2137.586766][T31000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2137.586774][T31000] R13: 00007fb67ffe6038 R14: 00007fb67ffe5fa0 R15: 00007fb68010fa28 [ 2137.586796][T31000] [ 2137.904527][T29045] usb 6-1: Manufacturer: syz [ 2137.909176][T29045] usb 6-1: SerialNumber: syz [ 2138.218767][T15480] input: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input64 [ 2138.313351][T30982] usb usb8: usbfs: process 30982 (syz.1.6890) did not claim interface 3 before use [ 2138.352370][T31001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2138.431737][T31001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2138.489367][T30990] vivid-007: disconnect [ 2138.623601][T30988] vivid-007: reconnect [ 2139.001930][T25884] usb 2-1: USB disconnect, device number 79 [ 2140.200110][T29045] cypress_m8 6-1:149.17: HID->COM RS232 Adapter converter detected [ 2140.211767][T29045] cyphidcom ttyUSB0: required endpoint is missing [ 2140.267102][T29045] usb 6-1: USB disconnect, device number 74 [ 2140.302850][T29045] cypress_m8 6-1:149.17: device disconnected [ 2140.338678][T24503] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 2140.509407][T24503] usb 4-1: Using ep0 maxpacket: 32 [ 2140.524317][T24503] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2140.566351][T24503] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 2140.582559][T24503] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 2140.612767][T24503] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 2140.632063][T24503] usb 4-1: config 128 has no interface number 0 [ 2140.658812][T24503] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 1828, setting to 1024 [ 2140.678664][T29045] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 2140.693605][T24503] usb 4-1: config 128 interface 127 has no altsetting 0 [ 2140.707262][T31029] netlink: 'syz.4.6902': attribute type 1 has an invalid length. [ 2140.723294][T24503] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 2140.752958][T24503] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2140.791138][T24503] usb 4-1: Product: syz [ 2140.835800][T24503] usb 4-1: Manufacturer: syz [ 2140.853657][T24503] usb 4-1: SerialNumber: syz [ 2140.874901][T29045] usb 6-1: New USB device found, idVendor=090a, idProduct=1200, bcdDevice=24.87 [ 2140.894364][T29045] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2140.900042][T31029] 8021q: adding VLAN 0 to HW filter on device bond3 [ 2140.939293][T31016] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 2140.954137][T29045] usb 6-1: config 0 descriptor?? [ 2140.976739][T29045] usb-storage 6-1:0.0: USB Mass Storage device detected [ 2141.020965][T29045] usb-storage 6-1:0.0: This device (090a,1200,2487 S 01 P 00) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 2141.020965][T29045] Please send a copy of this message to and [ 2141.181794][T29045] usb 6-1: USB disconnect, device number 75 [ 2141.401309][T24503] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2141.477640][T24503] usb 4-1: USB disconnect, device number 91 [ 2141.585125][T27773] udevd[27773]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2142.156265][T31044] FAULT_INJECTION: forcing a failure. [ 2142.156265][T31044] name failslab, interval 1, probability 0, space 0, times 0 [ 2142.207625][T31044] CPU: 1 UID: 0 PID: 31044 Comm: syz.4.6906 Not tainted syzkaller #0 PREEMPT(full) [ 2142.207653][T31044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2142.207667][T31044] Call Trace: [ 2142.207675][T31044] [ 2142.207684][T31044] dump_stack_lvl+0x189/0x250 [ 2142.207711][T31044] ? __pfx____ratelimit+0x10/0x10 [ 2142.207741][T31044] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2142.207761][T31044] ? __pfx__printk+0x10/0x10 [ 2142.207791][T31044] ? __pfx___might_resched+0x10/0x10 [ 2142.207811][T31044] ? fs_reclaim_acquire+0x7d/0x100 [ 2142.207836][T31044] should_fail_ex+0x414/0x560 [ 2142.207867][T31044] should_failslab+0xa8/0x100 [ 2142.207890][T31044] kmem_cache_alloc_noprof+0x74/0x6e0 [ 2142.207919][T31044] ? skb_clone+0x212/0x3a0 [ 2142.207945][T31044] skb_clone+0x212/0x3a0 [ 2142.207974][T31044] pfkey_sendmsg+0x44b/0x1090 [ 2142.208017][T31044] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2142.208068][T31044] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2142.208095][T31044] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2142.208116][T31044] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2142.208143][T31044] __sock_sendmsg+0x21c/0x270 [ 2142.208170][T31044] ____sys_sendmsg+0x52d/0x820 [ 2142.208206][T31044] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2142.208246][T31044] ? import_iovec+0x74/0xa0 [ 2142.208271][T31044] ___sys_sendmsg+0x21f/0x2a0 [ 2142.208303][T31044] ? __pfx____sys_sendmsg+0x10/0x10 [ 2142.208378][T31044] ? __fget_files+0x2a/0x420 [ 2142.208398][T31044] ? __fget_files+0x3a0/0x420 [ 2142.208429][T31044] __sys_sendmmsg+0x227/0x430 [ 2142.208466][T31044] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2142.208503][T31044] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2142.208536][T31044] ? ksys_write+0x22a/0x250 [ 2142.208566][T31044] ? __pfx_ksys_write+0x10/0x10 [ 2142.208598][T31044] __x64_sys_sendmmsg+0xa0/0xc0 [ 2142.208629][T31044] do_syscall_64+0xfa/0xf80 [ 2142.208644][T31044] ? lockdep_hardirqs_on+0x98/0x140 [ 2142.208672][T31044] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2142.208690][T31044] ? clear_bhb_loop+0x60/0xb0 [ 2142.208714][T31044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2142.208733][T31044] RIP: 0033:0x7fb0e018f749 [ 2142.208749][T31044] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2142.208766][T31044] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2142.208786][T31044] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2142.208800][T31044] RDX: 0229ffa1c4ce5369 RSI: 0000200000000180 RDI: 0000000000000003 [ 2142.208813][T31044] RBP: 00007fb0e10f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2142.208825][T31044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2142.208836][T31044] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2142.208866][T31044] [ 2142.638850][T19690] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 2142.798703][T19690] usb 4-1: Using ep0 maxpacket: 32 [ 2142.805507][T19690] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 2142.828171][T19690] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 2142.855237][T19690] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 2142.909033][T19690] usb 4-1: Product: syz [ 2142.955650][T19690] usb 4-1: Manufacturer: syz [ 2142.987017][T19690] usb 4-1: SerialNumber: syz [ 2143.033236][T19690] usb 4-1: config 0 descriptor?? [ 2143.064330][T31043] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 2143.084388][T31055] xt_NFQUEUE: number of queues (1024) out of range (got 66558) [ 2143.084503][T19690] hub 4-1:0.0: bad descriptor, ignoring hub [ 2143.166018][T19690] hub 4-1:0.0: probe with driver hub failed with error -5 [ 2143.328764][T31043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2143.347578][T31043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2143.388767][T24503] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 2143.477562][T31062] netlink: 27 bytes leftover after parsing attributes in process `syz.3.6905'. [ 2143.550273][T24503] usb 2-1: Using ep0 maxpacket: 32 [ 2143.559326][T24503] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 2143.578426][T24503] usb 2-1: config 0 has no interface number 0 [ 2143.597587][T24503] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 2143.650566][T24503] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2143.709041][T24503] usb 2-1: Product: syz [ 2143.733708][T24503] usb 2-1: Manufacturer: syz [ 2143.756660][T24503] usb 2-1: SerialNumber: syz [ 2143.815533][T24503] usb 2-1: config 0 descriptor?? [ 2143.843806][T24503] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 2143.958729][T25884] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 2144.151909][T24503] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 2144.168595][T25884] usb 6-1: Using ep0 maxpacket: 16 [ 2144.182963][T31073] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6912'. [ 2144.220630][T24503] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 2144.230677][T25884] usb 6-1: config 149 has an invalid interface number: 17 but max is 0 [ 2144.274810][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 9 [ 2144.315885][T25884] usb 6-1: config 149 has no interface number 0 [ 2144.336902][T25884] usb 6-1: config 149 interface 17 has no altsetting 0 [ 2144.391607][T25884] usb 6-1: New USB device found, idVendor=0d9f, idProduct=0002, bcdDevice=65.f4 [ 2144.422446][T25884] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2144.440783][T25884] usb 6-1: Product: syz [ 2144.445210][T25884] usb 6-1: Manufacturer: syz [ 2144.462021][T25884] usb 6-1: SerialNumber: syz [ 2144.486553][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 2144.495196][T24503] usb 2-1: USB disconnect, device number 80 [ 2144.522448][T24503] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 2144.612707][T24503] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 2144.677265][T24503] quatech2 2-1:0.51: device disconnected [ 2144.987156][T15480] usb 4-1: USB disconnect, device number 92 [ 2145.786854][T31088] loop6: detected capacity change from 0 to 524288000 [ 2145.847492][T31088] netlink: 388 bytes leftover after parsing attributes in process `syz.4.6915'. [ 2147.118991][T19696] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2147.201417][T10903] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2147.387645][T25884] cypress_m8 6-1:149.17: HID->COM RS232 Adapter converter detected [ 2147.452924][T25884] cyphidcom ttyUSB0: required endpoint is missing [ 2147.486717][T25884] usb 6-1: USB disconnect, device number 76 [ 2147.546856][T25884] cypress_m8 6-1:149.17: device disconnected [ 2147.787057][T31099] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6918'. [ 2147.949493][T25884] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2148.013649][T31105] loop6: detected capacity change from 0 to 524288000 [ 2148.243828][T31107] input: syz0 as /devices/virtual/input/input65 [ 2148.274039][ T7076] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2148.333135][ T7076] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2148.368765][T19693] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2148.621367][T31113] netlink: 'syz.6.6921': attribute type 1 has an invalid length. [ 2148.857885][T31113] 8021q: adding VLAN 0 to HW filter on device bond2 [ 2148.898685][T25884] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 2149.081991][T25884] usb 6-1: Using ep0 maxpacket: 16 [ 2149.122936][T25884] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 2149.179242][T25884] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 2149.242729][T25884] usb 6-1: Product: syz [ 2149.280016][T25884] usb 6-1: Manufacturer: syz [ 2149.299916][T25884] usb 6-1: SerialNumber: syz [ 2149.317216][T31123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6925'. [ 2149.347704][T25884] usb 6-1: config 0 descriptor?? [ 2149.432216][T31124] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6924'. [ 2149.655383][T22299] usb 6-1: USB disconnect, device number 77 [ 2150.496323][T31139] netlink: 140 bytes leftover after parsing attributes in process `syz.1.6928'. [ 2150.732567][T31146] FAULT_INJECTION: forcing a failure. [ 2150.732567][T31146] name failslab, interval 1, probability 0, space 0, times 0 [ 2150.828236][T19695] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 2150.837998][T31146] CPU: 1 UID: 0 PID: 31146 Comm: syz.4.6931 Not tainted syzkaller #0 PREEMPT(full) [ 2150.838018][T31146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2150.838029][T31146] Call Trace: [ 2150.838035][T31146] [ 2150.838043][T31146] dump_stack_lvl+0x189/0x250 [ 2150.838064][T31146] ? __pfx____ratelimit+0x10/0x10 [ 2150.838087][T31146] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2150.838103][T31146] ? __pfx__printk+0x10/0x10 [ 2150.838124][T31146] ? __lock_acquire+0x6b6/0x2cf0 [ 2150.838155][T31146] should_fail_ex+0x414/0x560 [ 2150.838178][T31146] should_failslab+0xa8/0x100 [ 2150.838196][T31146] kmem_cache_alloc_noprof+0x74/0x6e0 [ 2150.838221][T31146] ? skb_clone+0x212/0x3a0 [ 2150.838239][T31146] skb_clone+0x212/0x3a0 [ 2150.838256][T31146] __netlink_deliver_tap+0x404/0x850 [ 2150.838288][T31146] ? netlink_deliver_tap+0x2e/0x1b0 [ 2150.838310][T31146] netlink_deliver_tap+0x19c/0x1b0 [ 2150.838334][T31146] netlink_unicast+0x7fa/0x9e0 [ 2150.838360][T31146] ? __pfx_netlink_unicast+0x10/0x10 [ 2150.838381][T31146] ? netlink_sendmsg+0x642/0xb30 [ 2150.838402][T31146] ? skb_put+0x11b/0x210 [ 2150.838425][T31146] netlink_sendmsg+0x805/0xb30 [ 2150.838457][T31146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2150.838496][T31146] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2150.838524][T31146] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2150.838544][T31146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2150.838576][T31146] __sock_sendmsg+0x21c/0x270 [ 2150.838604][T31146] ____sys_sendmsg+0x505/0x820 [ 2150.838642][T31146] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2150.838683][T31146] ? import_iovec+0x74/0xa0 [ 2150.838708][T31146] ___sys_sendmsg+0x21f/0x2a0 [ 2150.838733][T31146] ? __pfx____sys_sendmsg+0x10/0x10 [ 2150.838762][T31146] ? rcu_read_lock_any_held+0xb3/0x120 [ 2150.838798][T31146] ? __fget_files+0x2a/0x420 [ 2150.838814][T31146] ? __fget_files+0x3a0/0x420 [ 2150.838838][T31146] __x64_sys_sendmsg+0x19b/0x260 [ 2150.838864][T31146] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2150.838904][T31146] ? __pfx_ksys_write+0x10/0x10 [ 2150.838928][T31146] ? do_syscall_64+0xbe/0xf80 [ 2150.838943][T31146] do_syscall_64+0xfa/0xf80 [ 2150.838970][T31146] ? lockdep_hardirqs_on+0x98/0x140 [ 2150.839009][T31146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2150.839024][T31146] ? clear_bhb_loop+0x60/0xb0 [ 2150.839042][T31146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2150.839057][T31146] RIP: 0033:0x7fb0e018f749 [ 2150.839071][T31146] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2150.839085][T31146] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2150.839101][T31146] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2150.839113][T31146] RDX: 0000000000000040 RSI: 0000200000000280 RDI: 0000000000000006 [ 2150.839123][T31146] RBP: 00007fb0e10f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2150.839132][T31146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2150.839141][T31146] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2150.839165][T31146] [ 2151.539006][T31146] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6931'. [ 2151.709088][T19695] usb 2-1: Using ep0 maxpacket: 16 [ 2151.728114][T31155] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6933'. [ 2151.767352][T19695] usb 2-1: config 149 has an invalid interface number: 17 but max is 0 [ 2151.797458][T31155] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6933'. [ 2151.797465][T19695] usb 2-1: config 149 has no interface number 0 [ 2151.797500][T19695] usb 2-1: config 149 interface 17 has no altsetting 0 [ 2151.907871][T19695] usb 2-1: New USB device found, idVendor=0d9f, idProduct=0002, bcdDevice=65.f4 [ 2151.942344][T19695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2151.981870][T19695] usb 2-1: Product: syz [ 2151.986075][T19695] usb 2-1: Manufacturer: syz [ 2152.024960][T19695] usb 2-1: SerialNumber: syz [ 2152.029971][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2152.078633][T19691] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 2152.268781][T19691] usb 6-1: Using ep0 maxpacket: 32 [ 2152.295434][T19691] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 2152.361406][T19691] usb 6-1: config 0 has no interface number 0 [ 2152.370347][T19691] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2152.402987][T19691] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 2152.416270][T19691] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2152.479698][T19691] usb 6-1: Product: syz [ 2152.489844][T19691] usb 6-1: Manufacturer: syz [ 2152.497875][T19691] usb 6-1: SerialNumber: syz [ 2152.517056][T19691] usb 6-1: config 0 descriptor?? [ 2152.607352][T19691] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 2152.659026][T19691] em28xx 6-1:0.132: Video interface 132 found: [ 2152.987316][T19691] em28xx 6-1:0.132: unknown em28xx chip ID (0) [ 2153.148686][T17989] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 2153.313436][T17989] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 2153.336744][T31155] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2153.348628][T15480] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 2153.363040][T17989] usb 4-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 2153.379642][T31155] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2153.391952][T17989] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2153.401876][T17989] usb 4-1: Product: syz [ 2153.406198][T17989] usb 4-1: Manufacturer: syz [ 2153.413659][T17989] usb 4-1: SerialNumber: syz [ 2153.441974][T17989] usb 4-1: config 0 descriptor?? [ 2153.459821][T17989] hub 4-1:0.0: bad descriptor, ignoring hub [ 2153.474532][T17989] hub 4-1:0.0: probe with driver hub failed with error -5 [ 2153.488806][T31175] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6939'. [ 2153.504301][T17989] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input66 [ 2153.554292][T15480] usb 5-1: config 0 has an invalid interface number: 99 but max is 0 [ 2153.579043][T15480] usb 5-1: config 0 has no interface number 0 [ 2153.637654][T15480] usb 5-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 2153.668633][T15480] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2153.676963][T15480] usb 5-1: Product: syz [ 2153.694660][T15480] usb 5-1: Manufacturer: syz [ 2153.729083][T15480] usb 5-1: SerialNumber: syz [ 2153.753174][T15480] usb 5-1: config 0 descriptor?? [ 2153.769738][T15480] peak_usb 5-1:0.99: probe with driver peak_usb failed with error 99 [ 2153.941191][T17989] usb 4-1: USB disconnect, device number 93 [ 2154.032396][T19695] cypress_m8 2-1:149.17: HID->COM RS232 Adapter converter detected [ 2154.056576][T19695] cyphidcom ttyUSB0: required endpoint is missing [ 2154.082316][T19695] usb 2-1: USB disconnect, device number 81 [ 2154.127012][T19695] cypress_m8 2-1:149.17: device disconnected [ 2154.191066][T19691] em28xx 6-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 2154.207620][T31152] em28xx 6-1:0.132: failed to trigger read from i2c address 0x0 (error=-5) [ 2154.217467][T19691] em28xx 6-1:0.132: board has no eeprom [ 2154.279228][T19691] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 2154.302888][T19691] em28xx 6-1:0.132: analog set to bulk mode. [ 2154.314081][T19690] em28xx 6-1:0.132: Registering V4L2 extension [ 2154.340589][T19691] usb 6-1: USB disconnect, device number 78 [ 2154.356894][T19691] em28xx 6-1:0.132: Disconnecting em28xx [ 2154.478417][T31191] bond2: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 2154.479227][T19690] em28xx 6-1:0.132: Config register raw data: 0xffffffed [ 2154.520422][T19690] em28xx 6-1:0.132: AC97 chip type couldn't be determined [ 2154.521761][T31191] bond2 (unregistering): Released all slaves [ 2154.544857][T19690] em28xx 6-1:0.132: No AC97 audio processor [ 2154.566425][T19690] usb 6-1: Decoder not found [ 2154.571355][T19690] em28xx 6-1:0.132: failed to create media graph [ 2154.580878][T19690] em28xx 6-1:0.132: V4L2 device video103 deregistered [ 2154.593272][T19690] em28xx 6-1:0.132: Remote control support is not available for this card. [ 2154.603076][T19695] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 2154.611381][T19691] em28xx 6-1:0.132: Closing input extension [ 2154.626918][T19691] em28xx 6-1:0.132: Freeing device [ 2154.749300][T19695] usb 2-1: device descriptor read/64, error -71 [ 2154.951598][T31198] netlink: 25 bytes leftover after parsing attributes in process `syz.6.6943'. [ 2155.018642][T19695] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 2155.084584][T15480] usb 5-1: USB disconnect, device number 99 [ 2155.158630][T19695] usb 2-1: device descriptor read/64, error -71 [ 2155.198868][T17989] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 2155.268767][T19695] usb usb2-port1: attempt power cycle [ 2155.284542][T31208] IPVS: set_ctl: invalid protocol: 0 100.1.1.1:20002 [ 2155.335037][T31211] IPVS: set_ctl: invalid protocol: 51 10.1.1.2:20001 [ 2155.368650][T17989] usb 6-1: Using ep0 maxpacket: 8 [ 2155.394953][T17989] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2155.424039][T17989] usb 6-1: config 4 interface 0 has no altsetting 0 [ 2155.446545][T31209] team0: entered promiscuous mode [ 2155.458424][T31209] team_slave_0: entered promiscuous mode [ 2155.471311][T17989] usb 6-1: string descriptor 0 read error: -22 [ 2155.483301][T17989] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2155.508980][T31209] team_slave_1: entered promiscuous mode [ 2155.511110][T17989] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2155.561887][T31209] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 2155.586517][T17989] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2155.617947][T17989] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2155.628864][T19695] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 2155.657389][T17989] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2155.682749][T17989] usb 6-1: media controller created [ 2155.699546][T19695] usb 2-1: device descriptor read/8, error -71 [ 2155.717564][T17989] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2155.765965][T31199] usb 6-1: dvb_usb_au6610: wlen=0, aborting [ 2155.988687][T19695] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 2156.024199][T17989] usb 6-1: USB disconnect, device number 79 [ 2156.070014][T19695] usb 2-1: device descriptor read/8, error -71 [ 2156.209349][T19695] usb usb2-port1: unable to enumerate USB device [ 2156.428943][T15480] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 2156.600380][T15480] usb 4-1: Using ep0 maxpacket: 32 [ 2156.607547][T15480] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 2156.616257][T15480] usb 4-1: config 0 has no interface number 0 [ 2156.623615][T15480] usb 4-1: config 0 interface 184 altsetting 7 has an endpoint descriptor with address 0x1A, changing to 0xA [ 2156.636077][T15480] usb 4-1: config 0 interface 184 has no altsetting 0 [ 2156.650618][T15480] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 2156.661159][T15480] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2156.677315][T15480] usb 4-1: Product: syz [ 2156.682782][T15480] usb 4-1: Manufacturer: syz [ 2156.687421][T15480] usb 4-1: SerialNumber: syz [ 2156.709061][T15480] usb 4-1: config 0 descriptor?? [ 2156.729904][T15480] smsc75xx v1.0.0 [ 2157.060397][T31228] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2157.519319][T31231] FAULT_INJECTION: forcing a failure. [ 2157.519319][T31231] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2157.705390][T31231] CPU: 0 UID: 0 PID: 31231 Comm: syz.1.6952 Not tainted syzkaller #0 PREEMPT(full) [ 2157.705420][T31231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2157.705431][T31231] Call Trace: [ 2157.705438][T31231] [ 2157.705444][T31231] dump_stack_lvl+0x189/0x250 [ 2157.705464][T31231] ? __pfx____ratelimit+0x10/0x10 [ 2157.705484][T31231] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2157.705503][T31231] ? __pfx__printk+0x10/0x10 [ 2157.705522][T31231] ? __might_fault+0xb0/0x130 [ 2157.705550][T31231] should_fail_ex+0x414/0x560 [ 2157.705572][T31231] _copy_from_user+0x2d/0xb0 [ 2157.705586][T31231] ___sys_sendmsg+0x158/0x2a0 [ 2157.705610][T31231] ? __pfx____sys_sendmsg+0x10/0x10 [ 2157.705629][T31231] ? __lock_acquire+0x6b6/0x2cf0 [ 2157.705707][T31231] ? __might_fault+0xb0/0x130 [ 2157.705740][T31231] __sys_sendmmsg+0x227/0x430 [ 2157.705775][T31231] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2157.705814][T31231] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2157.705850][T31231] ? ksys_write+0x22a/0x250 [ 2157.705883][T31231] ? __pfx_ksys_write+0x10/0x10 [ 2157.705918][T31231] __x64_sys_sendmmsg+0xa0/0xc0 [ 2157.705950][T31231] do_syscall_64+0xfa/0xf80 [ 2157.705969][T31231] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2157.705988][T31231] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2157.706007][T31231] ? clear_bhb_loop+0x60/0xb0 [ 2157.706032][T31231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2157.706051][T31231] RIP: 0033:0x7fc2fb38f749 [ 2157.706068][T31231] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2157.706085][T31231] RSP: 002b:00007fc2fc2a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2157.706107][T31231] RAX: ffffffffffffffda RBX: 00007fc2fb5e5fa0 RCX: 00007fc2fb38f749 [ 2157.706122][T31231] RDX: 0229ffa1c4ce5369 RSI: 0000200000000180 RDI: 0000000000000003 [ 2157.706136][T31231] RBP: 00007fc2fc2a9090 R08: 0000000000000000 R09: 0000000000000000 [ 2157.706148][T31231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2157.706160][T31231] R13: 00007fc2fb5e6038 R14: 00007fc2fb5e5fa0 R15: 00007fc2fb70fa28 [ 2157.706208][T31231] [ 2158.659762][T19693] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 2158.719026][T19690] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 2158.819331][T19693] usb 2-1: Using ep0 maxpacket: 16 [ 2158.827804][T19693] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 2158.842122][T19693] usb 2-1: config 0 has no interface number 0 [ 2158.868663][T19690] usb 6-1: Using ep0 maxpacket: 8 [ 2158.880289][T19693] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 2158.927127][T19693] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2158.962106][T31242] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6954'. [ 2158.963504][T19693] usb 2-1: Product: syz [ 2158.992916][T19693] usb 2-1: Manufacturer: syz [ 2159.050769][T19693] usb 2-1: SerialNumber: syz [ 2159.089137][T19693] usb 2-1: config 0 descriptor?? [ 2159.098684][T19690] usb 6-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2159.146182][T19693] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 2159.161251][T19690] usb 6-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2159.226143][T19690] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2159.233164][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2159.327795][T19690] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2159.378332][T19690] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2159.434187][T19690] usb 6-1: config 0 descriptor?? [ 2159.504079][T19693] gspca_spca1528: reg_w err -71 [ 2159.535169][T19693] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 2159.575479][T19693] usb 2-1: USB disconnect, device number 86 [ 2160.099598][T31236] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2161.071258][T15480] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 2161.082530][T15480] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 2161.095149][T15480] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 2161.106294][T15480] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 2161.137333][T15480] usb 4-1: USB disconnect, device number 94 [ 2162.019272][T19690] usbhid 6-1:0.0: can't add hid device: -71 [ 2162.027701][T19690] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2162.047460][T19690] usb 6-1: USB disconnect, device number 80 [ 2163.012670][T31292] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2163.181110][T31294] netlink: 492 bytes leftover after parsing attributes in process `syz.6.6969'. [ 2163.986272][T31311] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2164.210376][T19693] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 2164.436937][T19693] usb 6-1: Using ep0 maxpacket: 8 [ 2164.495459][T19693] usb 6-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2164.596486][T19693] usb 6-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2164.690933][T19693] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2164.734620][T31323] netlink: 24 bytes leftover after parsing attributes in process `syz.6.6978'. [ 2164.769972][T19693] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2164.823376][T31323] netem: invalid attributes len -24 [ 2164.843461][T19693] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2164.865103][T31323] netem: change failed [ 2164.944907][T19693] usb 6-1: config 0 descriptor?? [ 2165.433565][T31309] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2165.633095][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 2165.641377][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 2167.181200][T19693] usbhid 6-1:0.0: can't add hid device: -71 [ 2167.207621][T19693] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2167.227834][T19693] usb 6-1: USB disconnect, device number 81 [ 2167.381078][T31349] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6984'. [ 2167.481195][T31353] FAULT_INJECTION: forcing a failure. [ 2167.481195][T31353] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2167.499667][T31353] CPU: 1 UID: 0 PID: 31353 Comm: syz.5.6987 Not tainted syzkaller #0 PREEMPT(full) [ 2167.499696][T31353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2167.499707][T31353] Call Trace: [ 2167.499714][T31353] [ 2167.499721][T31353] dump_stack_lvl+0x189/0x250 [ 2167.499741][T31353] ? __pfx____ratelimit+0x10/0x10 [ 2167.499763][T31353] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2167.499779][T31353] ? __pfx__printk+0x10/0x10 [ 2167.499805][T31353] ? __might_fault+0xb0/0x130 [ 2167.499837][T31353] should_fail_ex+0x414/0x560 [ 2167.499861][T31353] _copy_from_iter+0x1de/0x1790 [ 2167.499888][T31353] ? rcu_is_watching+0x15/0xb0 [ 2167.499908][T31353] ? __pfx__copy_from_iter+0x10/0x10 [ 2167.499931][T31353] ? __build_skb_around+0x22d/0x3c0 [ 2167.499957][T31353] ? skb_put+0x11b/0x210 [ 2167.499980][T31353] pfkey_sendmsg+0x230/0x1090 [ 2167.500005][T31353] ? __pfx___might_resched+0x10/0x10 [ 2167.500025][T31353] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2167.500045][T31353] ? aa_sk_perm+0x160/0x920 [ 2167.500064][T31353] ? aa_sk_perm+0x7f0/0x920 [ 2167.500082][T31353] ? __lock_acquire+0x6b6/0x2cf0 [ 2167.500104][T31353] ? __pfx_aa_sk_perm+0x10/0x10 [ 2167.500118][T31353] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 2167.500142][T31353] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2167.500160][T31353] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2167.500176][T31353] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 2167.500195][T31353] __sock_sendmsg+0x21c/0x270 [ 2167.500214][T31353] ____sys_sendmsg+0x52d/0x820 [ 2167.500240][T31353] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2167.500269][T31353] ? import_iovec+0x74/0xa0 [ 2167.500286][T31353] ___sys_sendmsg+0x21f/0x2a0 [ 2167.500310][T31353] ? __pfx____sys_sendmsg+0x10/0x10 [ 2167.500330][T31353] ? __lock_acquire+0x6b6/0x2cf0 [ 2167.500382][T31353] ? __might_fault+0xb0/0x130 [ 2167.500405][T31353] __sys_sendmmsg+0x227/0x430 [ 2167.500432][T31353] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2167.500460][T31353] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2167.500487][T31353] ? ksys_write+0x22a/0x250 [ 2167.500510][T31353] ? __pfx_ksys_write+0x10/0x10 [ 2167.500535][T31353] __x64_sys_sendmmsg+0xa0/0xc0 [ 2167.500559][T31353] do_syscall_64+0xfa/0xf80 [ 2167.500571][T31353] ? lockdep_hardirqs_on+0x98/0x140 [ 2167.500593][T31353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2167.500607][T31353] ? clear_bhb_loop+0x60/0xb0 [ 2167.500624][T31353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2167.500639][T31353] RIP: 0033:0x7f861458f749 [ 2167.500652][T31353] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2167.500665][T31353] RSP: 002b:00007f861544a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2167.500681][T31353] RAX: ffffffffffffffda RBX: 00007f86147e5fa0 RCX: 00007f861458f749 [ 2167.500697][T31353] RDX: 0229ffa1c4ce5369 RSI: 0000200000000180 RDI: 0000000000000003 [ 2167.500707][T31353] RBP: 00007f861544a090 R08: 0000000000000000 R09: 0000000000000000 [ 2167.500729][T31353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2167.500738][T31353] R13: 00007f86147e6038 R14: 00007f86147e5fa0 R15: 00007f861490fa28 [ 2167.500760][T31353] [ 2167.813200][ C1] vkms_vblank_simulate: vblank timer overrun [ 2168.571158][T31355] xt_bpf: check failed: parse error [ 2168.729354][T29045] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 2168.839037][T22299] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 2168.888735][T29045] usb 2-1: Using ep0 maxpacket: 8 [ 2168.984594][T22299] usb 5-1: device descriptor read/64, error -71 [ 2169.137350][T31359] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6989'. [ 2169.247945][T22299] usb 5-1: new full-speed USB device number 101 using dummy_hcd [ 2169.389015][T22299] usb 5-1: device descriptor read/64, error -71 [ 2169.408575][T15480] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 2169.511727][T22299] usb usb5-port1: attempt power cycle [ 2169.526169][T29045] usb 2-1: config 127 has an invalid interface number: 171 but max is 1 [ 2169.545810][T29045] usb 2-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 2169.568822][T15480] usb 4-1: Using ep0 maxpacket: 32 [ 2169.577461][T15480] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2169.587261][T15480] usb 4-1: config 8 has an invalid interface number: 143 but max is 3 [ 2169.602535][T29045] usb 2-1: config 127 has no interface number 1 [ 2169.610065][T15480] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 2169.622440][T29045] usb 2-1: config 127 interface 171 has no altsetting 0 [ 2169.673803][T15480] usb 4-1: config 8 has 1 interface, different from the descriptor's value: 4 [ 2169.706701][T15480] usb 4-1: config 8 has no interface number 0 [ 2169.733530][T15480] usb 4-1: config 8 interface 143 altsetting 193 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 2169.766220][T15480] usb 4-1: config 8 interface 143 altsetting 193 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2169.786120][T15480] usb 4-1: config 8 interface 143 altsetting 193 bulk endpoint 0x9 has invalid maxpacket 0 [ 2169.805442][T15480] usb 4-1: config 8 interface 143 altsetting 193 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 2169.823568][T15480] usb 4-1: config 8 interface 143 has no altsetting 0 [ 2169.849417][T22299] usb 5-1: new full-speed USB device number 102 using dummy_hcd [ 2169.879716][T22299] usb 5-1: device descriptor read/8, error -71 [ 2169.895807][T15480] usb 4-1: New USB device found, idVendor=1608, idProduct=021d, bcdDevice= 8.a4 [ 2169.927995][T29045] usb 2-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 2169.937932][T29045] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2169.946103][T15480] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2169.946624][T29045] usb 2-1: Product: syz [ 2169.975116][T29045] usb 2-1: Manufacturer: syz [ 2169.980779][T29045] usb 2-1: SerialNumber: syz [ 2169.997989][T15480] usb 4-1: Product: syz [ 2170.007301][T15480] usb 4-1: Manufacturer: syz [ 2170.024754][T15480] usb 4-1: SerialNumber: syz [ 2170.118741][T22299] usb 5-1: new full-speed USB device number 103 using dummy_hcd [ 2170.140059][T22299] usb 5-1: device descriptor read/8, error -71 [ 2170.249995][T22299] usb usb5-port1: unable to enumerate USB device [ 2170.917448][T15480] io_ti 4-1:8.143: required endpoints missing [ 2170.966193][T15480] usb 4-1: USB disconnect, device number 95 [ 2171.387182][T29045] xr_serial 2-1:127.171: xr_serial converter detected [ 2171.406572][T29045] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 2171.425032][T29045] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 2171.458356][T29045] usb 2-1: USB disconnect, device number 87 [ 2171.491407][T29045] xr_serial 2-1:127.171: device disconnected [ 2171.813588][T31382] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6996'. [ 2172.208817][T22299] usb 2-1: new low-speed USB device number 88 using dummy_hcd [ 2172.443427][T22299] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 2172.468822][T22299] usb 2-1: config 0 has no interface number 0 [ 2172.550709][T22299] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 2172.600781][T22299] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 2172.636642][T22299] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2172.666985][T22299] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2172.707454][T22299] usb 2-1: config 0 descriptor?? [ 2172.735803][T31386] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 2172.757285][T22299] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2173.026856][T31386] binder: 31385:31386 ioctl 4018620d 0 returned -22 [ 2173.058809][T22299] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 2173.171899][T17989] usb 2-1: USB disconnect, device number 88 [ 2173.177906][ C0] iowarrior 2-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 2173.220835][T22299] usb 4-1: Using ep0 maxpacket: 8 [ 2173.231619][T22299] usb 4-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2173.263626][T22299] usb 4-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2173.301035][T22299] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2173.331005][T22299] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2173.355047][T22299] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2173.395959][T22299] usb 4-1: config 0 descriptor?? [ 2173.948850][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2173.963654][T31399] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2173.975551][T15480] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 2174.159318][T15480] usb 6-1: Using ep0 maxpacket: 16 [ 2174.204464][T15480] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2174.223719][T15480] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2174.239669][T15480] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 2174.252579][T15480] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 2174.263756][T15480] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2174.296839][T15480] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2174.327741][T15480] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2174.384281][T15480] usb 6-1: Manufacturer: syz [ 2174.435493][T15480] usb 6-1: config 0 descriptor?? [ 2174.441240][T17989] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 2174.497345][T31418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7005'. [ 2174.608836][T17989] usb 2-1: Using ep0 maxpacket: 32 [ 2174.623647][T17989] usb 2-1: config 0 has no interfaces? [ 2174.632146][T17989] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2174.642186][T17989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2174.659400][T17989] usb 2-1: config 0 descriptor?? [ 2175.048654][T15480] rc_core: IR keymap rc-hauppauge not found [ 2175.084609][T15480] Registered IR keymap rc-empty [ 2175.117019][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.169086][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.221902][T15480] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 2175.258306][T15480] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input67 [ 2175.293564][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.318954][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.370219][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.394159][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.438834][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.489461][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.558722][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.645982][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.668032][T31433] netlink: 72 bytes leftover after parsing attributes in process `syz.6.7007'. [ 2175.741530][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.801344][T15480] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 2175.848168][T31435] IPVS: set_ctl: invalid protocol: 171 172.20.20.170:20004 [ 2175.914849][T15480] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 2175.994095][T15480] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 2176.993768][T29045] usb 2-1: USB disconnect, device number 89 [ 2177.125830][T31440] geneve2: entered promiscuous mode [ 2177.617965][T31447] netlink: 388 bytes leftover after parsing attributes in process `syz.1.7011'. [ 2178.392110][T29045] usb 6-1: USB disconnect, device number 82 [ 2178.568409][T31463] netlink: 492 bytes leftover after parsing attributes in process `syz.5.7016'. [ 2179.069657][T22299] usbhid 4-1:0.0: can't add hid device: -32 [ 2179.146940][T22299] usbhid 4-1:0.0: probe with driver usbhid failed with error -32 [ 2179.296625][T29045] usb 4-1: USB disconnect, device number 96 [ 2180.080131][T31494] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7025'. [ 2180.208898][T31498] netlink: 492 bytes leftover after parsing attributes in process `syz.3.7027'. [ 2180.238548][T22299] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 2180.402986][ T30] audit: type=1326 audit(1764711545.471:4780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.425458][ C1] vkms_vblank_simulate: vblank timer overrun [ 2180.445914][T22299] usb 6-1: config 0 has an invalid interface number: 39 but max is 0 [ 2180.467702][T22299] usb 6-1: config 0 has no interface number 0 [ 2180.474117][T22299] usb 6-1: config 0 interface 39 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 2180.486839][T22299] usb 6-1: New USB device found, idVendor=0499, idProduct=4d3f, bcdDevice=d2.2a [ 2180.493477][T31504] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7028'. [ 2180.507091][T22299] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2180.517893][ T30] audit: type=1326 audit(1764711545.471:4781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.540376][ C1] vkms_vblank_simulate: vblank timer overrun [ 2180.557945][T22299] usb 6-1: Product: syz [ 2180.577982][T22299] usb 6-1: Manufacturer: syz [ 2180.584604][T22299] usb 6-1: SerialNumber: syz [ 2180.584644][ T30] audit: type=1326 audit(1764711545.501:4782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.618135][T22299] usb 6-1: config 0 descriptor?? [ 2180.698986][ T30] audit: type=1326 audit(1764711545.501:4783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.721505][ C1] vkms_vblank_simulate: vblank timer overrun [ 2180.771809][ T30] audit: type=1326 audit(1764711545.501:4784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.833575][ T30] audit: type=1326 audit(1764711545.501:4785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb0e018df90 code=0x7ffc0000 [ 2180.856029][ C1] vkms_vblank_simulate: vblank timer overrun [ 2180.936616][ T30] audit: type=1326 audit(1764711545.501:4786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2180.959091][ C1] vkms_vblank_simulate: vblank timer overrun [ 2181.029791][T31508] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2181.041373][ T30] audit: type=1326 audit(1764711545.531:4787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2181.124936][ T30] audit: type=1326 audit(1764711545.531:4788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2181.178350][T31511] Cannot find add_set index 0 as target [ 2181.202663][ T30] audit: type=1326 audit(1764711545.531:4789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31486 comm="syz.4.7023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0e018f749 code=0x7ffc0000 [ 2181.225144][ C1] vkms_vblank_simulate: vblank timer overrun [ 2181.403132][T22299] usb 6-1: USB disconnect, device number 83 [ 2181.445892][T27592] udevd[27592]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.39/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2182.199021][T15480] usb 4-1: new low-speed USB device number 97 using dummy_hcd [ 2182.349387][T15480] usb 4-1: device descriptor read/64, error -71 [ 2182.598663][T15480] usb 4-1: new low-speed USB device number 98 using dummy_hcd [ 2182.748611][T15480] usb 4-1: device descriptor read/64, error -71 [ 2182.859143][T15480] usb usb4-port1: attempt power cycle [ 2182.978878][T22299] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 2183.148908][T22299] usb 5-1: Using ep0 maxpacket: 8 [ 2183.194735][T22299] usb 5-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2183.203877][T31548] macvlan2: entered promiscuous mode [ 2183.211441][T15480] usb 4-1: new low-speed USB device number 99 using dummy_hcd [ 2183.219515][T31548] macvlan2: entered allmulticast mode [ 2183.219874][T22299] usb 5-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2183.244067][T22299] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2183.255965][T31550] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2183.263263][T15480] usb 4-1: device descriptor read/8, error -71 [ 2183.289351][T22299] usb 5-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2183.309063][T22299] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2183.338838][T22299] usb 5-1: config 0 descriptor?? [ 2183.518684][T29045] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 2183.518923][T15480] usb 4-1: new low-speed USB device number 100 using dummy_hcd [ 2183.561408][T15480] usb 4-1: device descriptor read/8, error -71 [ 2183.681961][T15480] usb usb4-port1: unable to enumerate USB device [ 2183.692155][T29045] usb 6-1: Using ep0 maxpacket: 32 [ 2183.739936][T29045] usb 6-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 2183.764490][T29045] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2183.786496][T29045] usb 6-1: Product: syz [ 2183.804249][T29045] usb 6-1: Manufacturer: syz [ 2183.811366][T29045] usb 6-1: SerialNumber: syz [ 2183.823725][T29045] usb 6-1: config 0 descriptor?? [ 2183.843481][T29045] ftdi_sio 6-1:0.0: Ignoring interface reserved for JTAG [ 2183.910144][T31527] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2184.148555][T15480] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 2184.308592][T15480] usb 2-1: Using ep0 maxpacket: 32 [ 2184.316511][T15480] usb 2-1: config 0 has an invalid interface number: 250 but max is 2 [ 2184.324974][T15480] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2184.336986][T15480] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 2184.348011][T15480] usb 2-1: config 0 has no interface number 0 [ 2184.357830][T15480] usb 2-1: New USB device found, idVendor=0408, idProduct=3090, bcdDevice=a6.3f [ 2184.367563][T15480] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2184.376183][T15480] usb 2-1: Product: syz [ 2184.380680][T15480] usb 2-1: Manufacturer: syz [ 2184.385297][T15480] usb 2-1: SerialNumber: syz [ 2184.394435][T15480] usb 2-1: config 0 descriptor?? [ 2184.404644][T15480] uvcvideo 2-1:0.250: probe with driver uvcvideo failed with error -22 [ 2184.606061][T29045] usb 2-1: USB disconnect, device number 90 [ 2185.374117][T31561] loop6: detected capacity change from 0 to 524288000 [ 2185.381996][T19691] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 2185.524992][T22299] usbhid 5-1:0.0: can't add hid device: -71 [ 2185.533005][T22299] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2185.563873][T19691] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 2185.587910][T19691] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 2185.599529][T22299] usb 5-1: USB disconnect, device number 104 [ 2185.613121][T19691] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2185.700502][T19691] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 2185.904737][T31556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2185.931030][T31556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2186.176135][T29045] usb 6-1: USB disconnect, device number 84 [ 2186.267435][T31570] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7047'. [ 2186.755776][T19691] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 2186.962113][T19691] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 2186.993561][T19691] stv0680 4-1:4.0: last error: 22, command = 0x78 [ 2187.033838][T19691] usb 4-1: USB disconnect, device number 101 [ 2187.976282][T31591] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2188.035615][T31595] input: syz0 as /devices/virtual/input/input68 [ 2188.323144][T31605] netlink: 492 bytes leftover after parsing attributes in process `syz.5.7057'. [ 2188.531907][T31610] netlink: 'syz.5.7058': attribute type 1 has an invalid length. [ 2188.953706][T31613] netlink: 388 bytes leftover after parsing attributes in process `syz.6.7059'. [ 2188.981222][T31610] 8021q: adding VLAN 0 to HW filter on device bond5 [ 2189.108582][T29045] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 2189.118577][T15480] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 2189.126453][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 2189.318700][T15480] usb 4-1: device descriptor read/64, error -32 [ 2189.338643][T29045] usb 2-1: Using ep0 maxpacket: 16 [ 2189.391228][T29045] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 2189.423154][T29045] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2189.458569][T29045] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2189.498083][T29045] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2189.710020][T15480] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 2189.806449][T29045] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2189.818860][T29045] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2189.838658][T29045] usb 2-1: Product: syz [ 2189.842950][T29045] usb 2-1: Manufacturer: syz [ 2189.847675][T29045] usb 2-1: SerialNumber: syz [ 2189.958574][T15480] usb 4-1: Using ep0 maxpacket: 8 [ 2190.144878][T15480] usb 4-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2190.196929][T15480] usb 4-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2190.238582][T15480] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2190.258533][T15480] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2190.302586][T15480] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2190.339892][T15480] usb 4-1: config 0 descriptor?? [ 2192.750912][T19691] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 2192.931235][T19691] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 2192.949679][T19691] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 2192.962419][T19691] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2192.972710][T19691] usb 5-1: config 1 has no interface number 1 [ 2192.978867][T17989] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 2192.988236][T19691] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2193.005872][T19691] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2193.069031][T19691] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2193.093633][T19691] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2193.127936][T19691] usb 5-1: Product: syz [ 2193.138648][T19691] usb 5-1: Manufacturer: syz [ 2193.141378][T17989] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 2193.157774][T19691] usb 5-1: SerialNumber: syz [ 2193.171361][T17989] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 2193.178818][T29045] usb 2-1: USB disconnect, device number 91 [ 2193.404639][T27592] udevd[27592]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2193.421861][T17989] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 2193.448374][T17989] usb 6-1: config 1 interface 0 altsetting 127 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2193.451494][T19691] usb 5-1: No endpoint at altset 1, falling back to MIDI 1.0 [ 2193.471726][T17989] usb 6-1: config 1 interface 0 has no altsetting 0 [ 2193.506004][T19691] usb 5-1: MIDIStreaming interface descriptor not found [ 2193.545294][T17989] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 2193.629540][T19691] usb 5-1: USB disconnect, device number 105 [ 2193.648820][T17989] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2193.658035][T17989] usb 6-1: Product: syz [ 2193.696478][T17989] usb 6-1: Manufacturer: syz [ 2193.721845][T17989] usb 6-1: SerialNumber: syz [ 2193.843401][T31648] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 2193.851452][T31648] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 2193.956374][T15480] usbhid 4-1:0.0: can't add hid device: -71 [ 2193.966735][T15480] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2194.045460][T15480] usb 4-1: USB disconnect, device number 103 [ 2194.063232][T17989] rtl8150 6-1:1.0: couldn't find required endpoints [ 2194.109124][T17989] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 2194.147796][T17989] usb 6-1: USB disconnect, device number 85 [ 2194.607388][T31674] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7076'. [ 2194.698639][T17989] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 2194.869712][T17989] usb 2-1: Using ep0 maxpacket: 32 [ 2194.890726][T17989] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2194.920153][T17989] usb 2-1: config 4 has an invalid interface number: 245 but max is 0 [ 2194.937109][T17989] usb 2-1: config 4 has no interface number 0 [ 2194.944209][T17989] usb 2-1: config 4 interface 245 has no altsetting 0 [ 2194.968844][T17989] usb 2-1: language id specifier not provided by device, defaulting to English [ 2195.012235][T17989] usb 2-1: New USB device found, idVendor=0bb4, idProduct=0a53, bcdDevice=df.cc [ 2195.035370][T17989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2195.056962][T17989] usb 2-1: Product: ỗ캑∨㿈㪈冗ϖ⠄짅즀亃꒔쟲ڤߚ聛뫻决伽ꀃ㌺ᓋ鶡瘆ꅾ짎䬑換滗᧙ᨷ [ 2195.078059][T17989] usb 2-1: Manufacturer:   [ 2195.084280][T17989] usb 2-1: SerialNumber: syz [ 2196.087448][T31699] netlink: 26 bytes leftover after parsing attributes in process `syz.5.7082'. [ 2196.109494][T31700] netlink: 26 bytes leftover after parsing attributes in process `syz.5.7082'. [ 2196.255723][T31703] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2196.547079][T31705] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7084'. [ 2197.098303][T31717] netlink: 'syz.6.7088': attribute type 29 has an invalid length. [ 2197.156724][T31717] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7088'. [ 2197.298680][T15480] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 2197.508668][T15480] usb 5-1: Using ep0 maxpacket: 8 [ 2197.559545][T15480] usb 5-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2197.593998][T17989] usb 2-1: USB disconnect, device number 92 [ 2197.627198][T15480] usb 5-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2197.656703][T15480] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2197.671925][T15480] usb 5-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2197.681628][T15480] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2197.704053][T15480] usb 5-1: config 0 descriptor?? [ 2198.298075][T31713] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2198.403246][T17989] usb 2-1: new full-speed USB device number 93 using dummy_hcd [ 2198.438356][T31735] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2198.624712][T17989] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2198.652908][T17989] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2198.697221][T17989] usb 2-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 2198.740833][T17989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2198.781579][T17989] usb 2-1: config 0 descriptor?? [ 2198.921961][T31743] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2199.218892][T17989] kye 0003:0458:0138.0034: unknown main item tag 0x0 [ 2199.225940][T17989] kye 0003:0458:0138.0034: item fetching failed at offset 6/7 [ 2199.229623][T31751] netlink: 48 bytes leftover after parsing attributes in process `syz.5.7098'. [ 2199.236650][T17989] kye 0003:0458:0138.0034: parse failed [ 2199.260252][T17989] kye 0003:0458:0138.0034: probe with driver kye failed with error -22 [ 2199.425413][T17989] usb 2-1: USB disconnect, device number 93 [ 2199.688642][T22299] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 2199.712348][T31759] netlink: 72 bytes leftover after parsing attributes in process `syz.5.7100'. [ 2199.828566][T22299] usb 4-1: device descriptor read/64, error -71 [ 2199.884296][T15480] usbhid 5-1:0.0: can't add hid device: -71 [ 2199.902327][T15480] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2199.921167][T15480] usb 5-1: USB disconnect, device number 106 [ 2200.088827][T22299] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 2200.228581][T22299] usb 4-1: device descriptor read/64, error -71 [ 2200.359064][T22299] usb usb4-port1: attempt power cycle [ 2200.708673][T22299] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 2200.727226][T31774] loop2: detected capacity change from 0 to 7 [ 2200.736195][T22299] usb 4-1: device descriptor read/8, error -71 [ 2200.744336][T31774] Dev loop2: unable to read RDB block 7 [ 2200.751320][T31774] loop2: unable to read partition table [ 2200.757138][T31774] loop2: partition table beyond EOD, truncated [ 2200.766183][T31774] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 2200.991135][T22299] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 2201.059994][T22299] usb 4-1: device descriptor read/8, error -71 [ 2201.075553][T31779] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2201.118616][T19691] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 2201.219901][T22299] usb usb4-port1: unable to enumerate USB device [ 2201.295818][T31785] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7110'. [ 2201.317911][T19691] usb 6-1: Using ep0 maxpacket: 32 [ 2201.331882][T19691] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 2201.354771][T19691] usb 6-1: config 0 has no interface number 0 [ 2201.409111][T19691] usb 6-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 2201.453137][T19691] usb 6-1: config 0 interface 1 has no altsetting 0 [ 2201.499923][T19691] usb 6-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 2201.525733][T31787] loop6: detected capacity change from 0 to 524288000 [ 2201.535796][T19691] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2201.567060][T19691] usb 6-1: Product: syz [ 2201.579607][T19691] usb 6-1: Manufacturer: syz [ 2201.591570][T19691] usb 6-1: SerialNumber: syz [ 2201.617990][T19691] usb 6-1: config 0 descriptor?? [ 2201.636042][T31787] netlink: 388 bytes leftover after parsing attributes in process `syz.1.7109'. [ 2201.862123][T19691] cx231xx 6-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 2201.891107][T19691] cx231xx 6-1:0.1: Failed to read PCB config [ 2201.907195][T19691] cx231xx 6-1:0.1: probe with driver cx231xx failed with error -71 [ 2201.933977][T19691] usb 6-1: USB disconnect, device number 86 [ 2202.369628][T19691] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 2202.528964][T19691] usb 6-1: Using ep0 maxpacket: 32 [ 2202.536353][T19691] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 2202.556153][T19691] usb 6-1: config 0 has no interface number 0 [ 2202.567778][T19691] usb 6-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 2202.604112][T19691] usb 6-1: config 0 interface 1 has no altsetting 0 [ 2202.622417][T31802] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2202.637807][T19691] usb 6-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 2202.666162][T19691] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2202.702415][T19691] usb 6-1: Product: syz [ 2202.716915][T19691] usb 6-1: Manufacturer: syz [ 2202.731255][T19691] usb 6-1: SerialNumber: syz [ 2202.732656][T31807] vxcan1: entered promiscuous mode [ 2202.746858][T19691] usb 6-1: config 0 descriptor?? [ 2202.752249][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 2202.797837][T31809] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7117'. [ 2203.000167][T19691] cx231xx 6-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 2203.017209][T19691] cx231xx 6-1:0.1: Identified as Conexant Hybrid TV - RDU253S (card=4) [ 2203.110909][T31813] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2203.139343][T19691] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --110 [ 2203.169126][T19691] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --32 [ 2203.190718][T19691] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --32 [ 2203.248221][T31776] fuse: Unknown parameter 'default_permissionsI<%˔uW2-{{y%x/bO' [ 2203.330282][T19691] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --110 [ 2203.350917][T31816] netlink: 388 bytes leftover after parsing attributes in process `syz.3.7120'. [ 2203.386973][T19691] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --32 [ 2203.412859][T19691] cx231xx 6-1:0.1: Failed to set devmode to analog: error: -32 [ 2203.459851][T19691] i2c i2c-2: Added multiplexed i2c bus 4 [ 2203.477122][T19691] i2c i2c-2: Added multiplexed i2c bus 5 [ 2203.484583][T19691] cx231xx 6-1:0.1: cx231xx_dev_init: Failed to set Power - errCode [-32]! [ 2203.493971][T19691] cx231xx 6-1:0.1: cx231xx_init_dev: cx231xx_i2c_register - errCode [-32]! [ 2203.566944][T19691] cx231xx 6-1:0.1: probe with driver cx231xx failed with error -32 [ 2203.732449][T19691] usb 6-1: USB disconnect, device number 87 [ 2203.925340][T31825] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7123'. [ 2204.958681][T25884] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 2205.168729][T25884] usb 2-1: device descriptor read/64, error -71 [ 2205.448872][T25884] usb 2-1: new full-speed USB device number 95 using dummy_hcd [ 2205.608720][T25884] usb 2-1: device descriptor read/64, error -71 [ 2205.739637][T25884] usb usb2-port1: attempt power cycle [ 2205.872122][T31844] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7128'. [ 2206.097556][T31848] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7130'. [ 2206.118862][T25884] usb 2-1: new full-speed USB device number 96 using dummy_hcd [ 2206.159221][T25884] usb 2-1: device descriptor read/8, error -71 [ 2206.348908][T22299] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 2206.408702][T25884] usb 2-1: new full-speed USB device number 97 using dummy_hcd [ 2206.439538][T25884] usb 2-1: device descriptor read/8, error -71 [ 2206.456507][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 2206.456525][ T30] audit: type=1326 audit(1764711571.521:4810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31852 comm="syz.6.7132" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb67fd8f749 code=0x7ffc0000 [ 2206.501047][T22299] usb 4-1: device descriptor read/64, error -71 [ 2206.507535][ T30] audit: type=1326 audit(1764711571.521:4811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31852 comm="syz.6.7132" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb67fd8f749 code=0x7ffc0000 [ 2206.553234][ T30] audit: type=1326 audit(1764711571.521:4812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31852 comm="syz.6.7132" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fb67fd8f749 code=0x7ffc0000 [ 2206.580894][T25884] usb usb2-port1: unable to enumerate USB device [ 2206.750040][T22299] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 2206.899014][T22299] usb 4-1: device descriptor read/64, error -71 [ 2207.018462][T22299] usb usb4-port1: attempt power cycle [ 2207.368616][T22299] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 2207.389567][T22299] usb 4-1: device descriptor read/8, error -71 [ 2207.638813][T22299] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 2207.671996][T22299] usb 4-1: device descriptor read/8, error -71 [ 2207.779643][T22299] usb usb4-port1: unable to enumerate USB device [ 2207.843007][T31869] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7135'. [ 2209.498757][T30609] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 2209.670726][T30609] usb 4-1: Using ep0 maxpacket: 8 [ 2209.895130][T30609] usb 4-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2209.956095][T30609] usb 4-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2210.029271][T22299] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 2210.039513][T30609] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2210.054823][T30609] usb 4-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2210.105688][T30609] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2210.167923][T30609] usb 4-1: config 0 descriptor?? [ 2210.208960][T22299] usb 2-1: Using ep0 maxpacket: 8 [ 2210.224894][T22299] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2210.253470][T22299] usb 2-1: config 4 interface 0 has no altsetting 0 [ 2210.272591][T22299] usb 2-1: string descriptor 0 read error: -22 [ 2210.279858][T22299] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2210.300188][T22299] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2210.338734][T19695] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 2210.347119][T22299] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2210.369415][T22299] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2210.380575][T22299] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2210.387868][T22299] usb 2-1: media controller created [ 2210.456604][T22299] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2210.501592][T19695] usb 6-1: config 0 interface 0 altsetting 60 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 2210.529189][T19695] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2210.547133][T19695] usb 6-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=ae.ad [ 2210.565473][T19695] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2210.600087][T19695] usb 6-1: config 0 descriptor?? [ 2210.927728][T31903] block device autoloading is deprecated and will be removed. [ 2210.939755][T31894] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 2210.974146][T19695] usb 6-1: string descriptor 0 read error: -71 [ 2210.991487][T19695] usb 6-1: ucan: probing device on interface #0 [ 2211.013695][T19695] usb 6-1: ucan: invalid endpoint configuration [ 2211.028150][T19695] usb 6-1: ucan: probe failed; try to update the device firmware [ 2211.065360][T19695] usb 6-1: USB disconnect, device number 88 [ 2211.144916][T31911] bridge0: entered allmulticast mode [ 2211.214203][T31912] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2211.355546][T31914] netlink: 492 bytes leftover after parsing attributes in process `syz.6.7148'. [ 2211.656955][T22299] usb 2-1: USB disconnect, device number 98 [ 2211.915496][T31930] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7152'. [ 2211.988534][T19695] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 2212.170112][T19695] usb 6-1: Using ep0 maxpacket: 8 [ 2212.220501][T19695] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2212.263334][T19695] usb 6-1: config 4 interface 0 has no altsetting 0 [ 2212.305902][T19695] usb 6-1: string descriptor 0 read error: -22 [ 2212.333580][T19695] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2212.383229][T19695] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2212.439316][T19695] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2212.511187][T19695] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2212.556801][T19695] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2212.583010][T19695] usb 6-1: media controller created [ 2212.656347][T19695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2213.737969][T19695] zl10353_read_register: readreg error (reg=127, ret==0) [ 2213.921672][T19695] usb 6-1: USB disconnect, device number 89 [ 2213.983360][T31949] netlink: 492 bytes leftover after parsing attributes in process `syz.5.7159'. [ 2214.109069][T19690] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 2214.279219][T19690] usb 5-1: Using ep0 maxpacket: 32 [ 2214.326282][T19690] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2214.347347][T19690] usb 5-1: New USB device found, idVendor=18d1, idProduct=9400, bcdDevice= 0.00 [ 2214.420266][T19690] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2214.432771][T19690] usb 5-1: config 0 descriptor?? [ 2214.895475][T19690] stadia 0003:18D1:9400.0035: item fetching failed at offset 0/4 [ 2214.909360][T19690] stadia 0003:18D1:9400.0035: parse failed [ 2214.932695][T19690] stadia 0003:18D1:9400.0035: probe with driver stadia failed with error -22 [ 2215.092660][T19690] usb 5-1: USB disconnect, device number 107 [ 2215.262718][T30609] usbhid 4-1:0.0: can't add hid device: -71 [ 2215.272366][T30609] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2215.350714][T30609] usb 4-1: USB disconnect, device number 112 [ 2215.670315][T31971] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 2216.039515][T25884] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 2216.219317][T19690] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 2216.227012][T25884] usb 6-1: Using ep0 maxpacket: 8 [ 2216.240703][T25884] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2216.257240][T25884] usb 6-1: config 4 interface 0 has no altsetting 0 [ 2216.271018][T25884] usb 6-1: string descriptor 0 read error: -22 [ 2216.283954][T25884] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2216.304578][T25884] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2216.349323][T25884] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2216.383789][T25884] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2216.394807][T19690] usb 2-1: Using ep0 maxpacket: 32 [ 2216.421058][T19690] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 2216.430785][T29045] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 2216.440057][T25884] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2216.457063][T19690] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2216.467819][T25884] usb 6-1: media controller created [ 2216.490040][T19690] usb 2-1: config 0 descriptor?? [ 2216.537996][T25884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2216.618603][T29045] usb 4-1: Using ep0 maxpacket: 16 [ 2216.632849][T29045] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 2216.652381][T29045] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2216.676954][T29045] usb 4-1: Product: syz [ 2216.688028][T29045] usb 4-1: Manufacturer: syz [ 2216.699999][T29045] usb 4-1: SerialNumber: syz [ 2216.716757][T19690] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 2216.725821][T29045] usb 4-1: config 0 descriptor?? [ 2216.752546][T19690] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2216.793641][T19690] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 2216.812130][T19690] usb 2-1: media controller created [ 2216.829033][T25884] zl10353_read_register: readreg error (reg=127, ret==0) [ 2216.887608][T19690] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2216.921167][T31985] usb 6-1: dvb_usb_au6610: wlen=0, aborting [ 2216.961732][T19690] az6027: usb out operation failed. (-71) [ 2216.981328][T25884] usb 6-1: USB disconnect, device number 90 [ 2216.988098][T19690] az6027: usb out operation failed. (-71) [ 2217.004766][T19690] stb0899_attach: Driver disabled by Kconfig [ 2217.022565][T19690] az6027: no front-end attached [ 2217.022565][T19690] [ 2217.031418][T19690] az6027: usb out operation failed. (-71) [ 2217.037511][T19690] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 2217.054792][T19690] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input70 [ 2217.084062][T19690] dvb-usb: schedule remote query interval to 400 msecs. [ 2217.101466][T19690] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 2217.127245][T19690] usb 2-1: USB disconnect, device number 99 [ 2217.176501][T19690] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 2217.198054][T29045] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 2217.217831][T29045] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2217.231662][T29045] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 2217.240967][T29045] usb 4-1: media controller created [ 2217.260335][T29045] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2217.664955][T32003] netlink: 388 bytes leftover after parsing attributes in process `syz.5.7175'. [ 2217.810199][T29045] zl10353_read_register: readreg error (reg=127, ret==0) [ 2217.817488][T31989] dtv5100: wlen = 0, aborting. [ 2217.829982][T29045] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 2217.852733][T29045] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 2218.992166][T32024] netlink: 25 bytes leftover after parsing attributes in process `syz.4.7180'. [ 2219.049609][T32028] FAULT_INJECTION: forcing a failure. [ 2219.049609][T32028] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2219.069256][T32028] CPU: 0 UID: 0 PID: 32028 Comm: syz.1.7182 Not tainted syzkaller #0 PREEMPT(full) [ 2219.069293][T32028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2219.069304][T32028] Call Trace: [ 2219.069329][T32028] [ 2219.069337][T32028] dump_stack_lvl+0x189/0x250 [ 2219.069364][T32028] ? __pfx____ratelimit+0x10/0x10 [ 2219.069393][T32028] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2219.069413][T32028] ? __pfx__printk+0x10/0x10 [ 2219.069440][T32028] ? __might_fault+0xb0/0x130 [ 2219.069478][T32028] should_fail_ex+0x414/0x560 [ 2219.069506][T32028] _copy_from_user+0x2d/0xb0 [ 2219.069527][T32028] ___sys_sendmsg+0x158/0x2a0 [ 2219.069560][T32028] ? __pfx____sys_sendmsg+0x10/0x10 [ 2219.069586][T32028] ? __lock_acquire+0x6b6/0x2cf0 [ 2219.069654][T32028] ? __might_fault+0xb0/0x130 [ 2219.069687][T32028] __sys_sendmmsg+0x227/0x430 [ 2219.069722][T32028] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2219.069761][T32028] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2219.069798][T32028] ? ksys_write+0x22a/0x250 [ 2219.069830][T32028] ? __pfx_ksys_write+0x10/0x10 [ 2219.069864][T32028] __x64_sys_sendmmsg+0xa0/0xc0 [ 2219.069896][T32028] do_syscall_64+0xfa/0xf80 [ 2219.069914][T32028] ? lockdep_hardirqs_on+0x98/0x140 [ 2219.069943][T32028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2219.069963][T32028] ? clear_bhb_loop+0x60/0xb0 [ 2219.069986][T32028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2219.070005][T32028] RIP: 0033:0x7fc2fb38f749 [ 2219.070023][T32028] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2219.070040][T32028] RSP: 002b:00007fc2fc2a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2219.070061][T32028] RAX: ffffffffffffffda RBX: 00007fc2fb5e5fa0 RCX: 00007fc2fb38f749 [ 2219.070076][T32028] RDX: 0229ffa1c4ce5369 RSI: 0000200000000180 RDI: 0000000000000003 [ 2219.070096][T32028] RBP: 00007fc2fc2a9090 R08: 0000000000000000 R09: 0000000000000000 [ 2219.070109][T32028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2219.070121][T32028] R13: 00007fc2fb5e6038 R14: 00007fc2fb5e5fa0 R15: 00007fc2fb70fa28 [ 2219.070153][T32028] [ 2219.428628][T17989] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 2219.538588][T30609] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 2219.588693][T17989] usb 6-1: Using ep0 maxpacket: 8 [ 2219.595304][T17989] usb 6-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 2219.615402][T17989] usb 6-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2219.630973][T17989] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2219.639119][T17989] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2219.648758][T17989] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2219.662506][T17989] usb 6-1: config 0 descriptor?? [ 2219.688830][T30609] usb 5-1: Using ep0 maxpacket: 8 [ 2219.697767][T30609] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2219.706961][T30609] usb 5-1: config 4 interface 0 has no altsetting 0 [ 2219.738742][T22299] usb 2-1: new full-speed USB device number 100 using dummy_hcd [ 2219.751160][T30609] usb 5-1: string descriptor 0 read error: -22 [ 2219.765072][T30609] usb 5-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 2219.775222][T30609] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2219.813968][T30609] usb 5-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 2219.885328][T30609] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2219.901441][T22299] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 2219.931325][T22299] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2219.946651][T30609] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 2219.965982][T22299] usb 2-1: config 0 descriptor?? [ 2219.974439][T30609] usb 5-1: media controller created [ 2220.012339][T22299] gspca_main: sunplus-2.14.0 probing 041e:400b [ 2220.041122][T32030] ------------[ cut here ]------------ [ 2220.046650][T32030] usb 4-1: BOGUS control dir, pipe 80007180 doesn't match bRequestType c0 [ 2220.055383][T32030] WARNING: drivers/usb/core/urb.c:414 at 0x0, CPU#1: syz.4.7183/32030 [ 2220.063628][T32030] Modules linked in: [ 2220.068465][T32030] CPU: 1 UID: 0 PID: 32030 Comm: syz.4.7183 Not tainted syzkaller #0 PREEMPT(full) [ 2220.077857][T32030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2220.088141][T32030] RIP: 0010:usb_submit_urb+0x112e/0x1890 [ 2220.094368][T32030] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9 [ 2220.116247][T32030] RSP: 0018:ffffc90003a6f800 EFLAGS: 00010246 [ 2220.122486][T32030] RAX: 0000000000000000 RBX: ffff88802772e400 RCX: 0000000080007180 [ 2220.130526][T32030] RDX: ffff8880354d3080 RSI: ffffffff8c128080 RDI: ffffffff8f8cb4e0 [ 2220.138658][T32030] RBP: 1ffff1100ea71970 R08: 00000000000000c0 R09: 0000000000000000 [ 2220.140859][T30609] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2220.146739][T32030] R10: ffffc90003a6f900 R11: fffff5200074df2c R12: ffff88802b95e100 [ 2220.146783][T32030] R13: ffff88807538cb80 R14: 0000000080007180 R15: ffff8880354d3080 [ 2220.146801][T32030] FS: 00007fb0e10f56c0(0000) GS:ffff8881261c5000(0000) knlGS:0000000000000000 [ 2220.180279][T32030] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2220.186905][T32030] CR2: 00002000002c9030 CR3: 000000005a852000 CR4: 00000000003526f0 [ 2220.195446][T32030] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 2220.203604][T32030] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2220.211651][T32030] Call Trace: [ 2220.214945][T32030] [ 2220.217905][T32030] ? __init_swait_queue_head+0xa9/0x150 [ 2220.223556][T32030] usb_start_wait_urb+0x114/0x4c0 [ 2220.228707][T32030] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 2220.234321][T32030] usb_control_msg+0x232/0x3e0 [ 2220.239149][T32030] dtv5100_i2c_msg+0x23f/0x310 [ 2220.244058][T32030] dtv5100_i2c_xfer+0x269/0x3c0 [ 2220.248984][T32030] __i2c_transfer+0x871/0x20e0 [ 2220.253795][T32030] ? lockdep_hardirqs_on+0x98/0x140 [ 2220.259051][T32030] ? __pfx___i2c_transfer+0x10/0x10 [ 2220.264267][T32030] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 2220.269700][T32030] ? i2c_transfer+0x120/0x3a0 [ 2220.274397][T32030] i2c_transfer+0x25b/0x3a0 [ 2220.278971][T32030] ? __pfx_i2c_transfer+0x10/0x10 [ 2220.284017][T32030] ? _copy_from_user+0x94/0xb0 [ 2220.288840][T32030] i2cdev_ioctl_rdwr+0x460/0x740 [ 2220.293789][T32030] i2cdev_ioctl+0x64b/0x7f0 [ 2220.298293][T32030] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 2220.303413][T32030] ? __fget_files+0x3a0/0x420 [ 2220.308115][T32030] ? __fget_files+0x2a/0x420 [ 2220.312979][T32030] ? bpf_lsm_file_ioctl+0x9/0x20 [ 2220.317948][T32030] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 2220.323124][T32030] __se_sys_ioctl+0xfc/0x170 [ 2220.327750][T32030] do_syscall_64+0xfa/0xf80 [ 2220.332340][T32030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2220.338453][T32030] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2220.344630][T32030] ? clear_bhb_loop+0x60/0xb0 [ 2220.349386][T32030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2220.355282][T32030] RIP: 0033:0x7fb0e018f749 [ 2220.359754][T32030] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2220.379468][T32030] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2220.387911][T32030] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2220.396469][T32030] RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004 [ 2220.404508][T32030] RBP: 00007fb0e0213f91 R08: 0000000000000000 R09: 0000000000000000 [ 2220.412627][T32030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2220.420678][T32030] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2220.428705][T32030] [ 2220.431752][T32030] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2220.439039][T32030] CPU: 1 UID: 0 PID: 32030 Comm: syz.4.7183 Not tainted syzkaller #0 PREEMPT(full) [ 2220.448427][T32030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2220.458493][T32030] Call Trace: [ 2220.461784][T32030] [ 2220.464731][T32030] dump_stack_lvl+0x99/0x250 [ 2220.469344][T32030] ? __asan_memcpy+0x40/0x70 [ 2220.473960][T32030] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2220.479173][T32030] ? __pfx__printk+0x10/0x10 [ 2220.483823][T32030] vpanic+0x237/0x6d0 [ 2220.487818][T32030] ? __pfx_vpanic+0x10/0x10 [ 2220.492323][T32030] ? is_bpf_text_address+0x292/0x2b0 [ 2220.497612][T32030] ? is_bpf_text_address+0x26/0x2b0 [ 2220.502821][T32030] panic+0xb9/0xc0 [ 2220.506548][T32030] ? __pfx_panic+0x10/0x10 [ 2220.510986][T32030] __warn+0x317/0x4b0 [ 2220.514984][T32030] __report_bug+0x288/0x500 [ 2220.519533][T32030] ? __pfx___report_bug+0x10/0x10 [ 2220.524585][T32030] ? stack_depot_save_flags+0x422/0x850 [ 2220.530154][T32030] report_bug_entry+0x16a/0x220 [ 2220.535043][T32030] ? usb_submit_urb+0x112e/0x1890 [ 2220.540080][T32030] ? usb_submit_urb+0x1133/0x1890 [ 2220.545110][T32030] handle_bug+0xca/0x200 [ 2220.549362][T32030] exc_invalid_op+0x1a/0x50 [ 2220.553878][T32030] asm_exc_invalid_op+0x1a/0x20 [ 2220.558755][T32030] RIP: 0010:usb_submit_urb+0x112e/0x1890 [ 2220.564412][T32030] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9 [ 2220.584025][T32030] RSP: 0018:ffffc90003a6f800 EFLAGS: 00010246 [ 2220.590125][T32030] RAX: 0000000000000000 RBX: ffff88802772e400 RCX: 0000000080007180 [ 2220.598101][T32030] RDX: ffff8880354d3080 RSI: ffffffff8c128080 RDI: ffffffff8f8cb4e0 [ 2220.606088][T32030] RBP: 1ffff1100ea71970 R08: 00000000000000c0 R09: 0000000000000000 [ 2220.614061][T32030] R10: ffffc90003a6f900 R11: fffff5200074df2c R12: ffff88802b95e100 [ 2220.622037][T32030] R13: ffff88807538cb80 R14: 0000000080007180 R15: ffff8880354d3080 [ 2220.630053][T32030] ? __init_swait_queue_head+0xa9/0x150 [ 2220.635612][T32030] usb_start_wait_urb+0x114/0x4c0 [ 2220.640644][T32030] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 2220.646231][T32030] usb_control_msg+0x232/0x3e0 [ 2220.651012][T32030] dtv5100_i2c_msg+0x23f/0x310 [ 2220.655791][T32030] dtv5100_i2c_xfer+0x269/0x3c0 [ 2220.660659][T32030] __i2c_transfer+0x871/0x20e0 [ 2220.665438][T32030] ? lockdep_hardirqs_on+0x98/0x140 [ 2220.670686][T32030] ? __pfx___i2c_transfer+0x10/0x10 [ 2220.675897][T32030] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 2220.681278][T32030] ? i2c_transfer+0x120/0x3a0 [ 2220.685959][T32030] i2c_transfer+0x25b/0x3a0 [ 2220.690467][T32030] ? __pfx_i2c_transfer+0x10/0x10 [ 2220.695510][T32030] ? _copy_from_user+0x94/0xb0 [ 2220.700282][T32030] i2cdev_ioctl_rdwr+0x460/0x740 [ 2220.705240][T32030] i2cdev_ioctl+0x64b/0x7f0 [ 2220.709746][T32030] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 2220.714781][T32030] ? __fget_files+0x3a0/0x420 [ 2220.719482][T32030] ? __fget_files+0x2a/0x420 [ 2220.724096][T32030] ? bpf_lsm_file_ioctl+0x9/0x20 [ 2220.729044][T32030] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 2220.734081][T32030] __se_sys_ioctl+0xfc/0x170 [ 2220.738688][T32030] do_syscall_64+0xfa/0xf80 [ 2220.743196][T32030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2220.749264][T32030] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2220.755426][T32030] ? clear_bhb_loop+0x60/0xb0 [ 2220.760109][T32030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2220.766125][T32030] RIP: 0033:0x7fb0e018f749 [ 2220.770542][T32030] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2220.790151][T32030] RSP: 002b:00007fb0e10f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2220.798586][T32030] RAX: ffffffffffffffda RBX: 00007fb0e03e5fa0 RCX: 00007fb0e018f749 [ 2220.806573][T32030] RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004 [ 2220.814557][T32030] RBP: 00007fb0e0213f91 R08: 0000000000000000 R09: 0000000000000000 [ 2220.822546][T32030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2220.830519][T32030] R13: 00007fb0e03e6038 R14: 00007fb0e03e5fa0 R15: 00007fb0e050fa28 [ 2220.838508][T32030] [ 2220.841879][T32030] Kernel Offset: disabled [ 2220.846238][T32030] Rebooting in 86400 seconds..