last executing test programs: 9m59.553443317s ago: executing program 0 (id=2776): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$kcm(0x11, 0xa, 0x300) recvmsg(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002400)=""/4098, 0xd5e}], 0x3a}, 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000005440)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)='+', 0x1}], 0x1}}], 0x1, 0x400c404) sendmmsg$inet6(r4, &(0x7f0000003640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040005) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000006a80)={0x0, 0x0, &(0x7f0000006a40)={&(0x7f0000006a00)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {0x0, 0x8001}}}, 0x1c}}, 0xc000) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd26, 0x2, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0x5}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x0, 0x3, 0x0, 0x0, {{0x0, 0x2, 0x7}, {0xa, 0x0, 0x0, "4a774399"}}}]}]}]}}]}, 0x5c}}, 0x0) 9m59.007180815s ago: executing program 0 (id=2778): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6c01000017040100000000000000000000000000000000000000ffffac1e0001000000e0000002000000000000000000000000fc020000000000000000000018bd00000000fe80001500000000000000000000000000000000ad509383dbb57ec01fce72785f68f42c55cff01111c4247e53ce9698826de27d1b408e39ef08e34d50546068999b288745507b50fc22e918572bdc3e208187c691c6c2b0c639f2dae061d5dd633563ea495e9f18f50473e686f4e7a391f37610544a56b516d793d1eb90c9115c60b394f02c4e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa000000000000000000000000ac14140000000000000000000000000000000000000000000200002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000b86b6e000000000000000000feffffff00000000000000000000000044000800000000000000000000000000000000010000000000000000000000007f00000100"/196], 0x16c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e20, 0x2, @empty, 0x4}}, 0x1, 0x7, 0xfffffffe, 0x401, 0x1}, 0x9c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r5}, &(0x7f00000002c0), &(0x7f0000000300)=r4}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) ioctl$DRM_IOCTL_MODE_SETPLANE(r2, 0x40806685, &(0x7f0000000280)={r6, 0x0, 0x0, 0x100000, 0x9, 0xf38, 0x401, 0x10000, 0xfffffffb, 0x164, 0x2, 0x48}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='thermal_zone_trip\x00', r2, 0x0, 0x9}, 0x18) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 9m57.843332778s ago: executing program 0 (id=2779): socket$inet6(0xa, 0x3, 0x8000000003c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsopen(&(0x7f00000002c0)='pstore\x00', 0x1) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pread64(r0, 0x0, 0x0, 0xfffffffffffffff7) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x42a00) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0x20) read$eventfd(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000300), 0x0, 0x40000) ioctl$CEC_ADAP_S_LOG_ADDRS(r3, 0xc05c6104, &(0x7f00000000c0)={"fbffffff", 0x0, 0x5, 0x4, 0xf, 0x0, "000000ff00070000000900", '\x00', "e20b0400", "076eade4", ['\x00', "00000012184eb81f43d83ba1", "0c000004dd372a9000"]}) r4 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000040)=0x44) ioctl$PIO_UNISCRNMAP(0xffffffffffffffff, 0x4b6a, &(0x7f00000002c0)="0b6e9a767190fb6b69da75d2628b6674dfbfed69d0efe8cdc786cdc422428947cb3963cc92ee0695244dfe0e2737d21961e70f7053aa308b01952aff01a23cb273bfa1c4775a42d00b9abeebb55e142e0cb128c12eecf56726353a461ea89d228e5a04611181316e2f670311822e8e04b739bb55e2ff7f41f6b4226b20591a34691901afc837f7c2ec42090835ebaff367d078b52cfa") openat$audio(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1d0}) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r5, 0x4008c001) 9m50.736366053s ago: executing program 0 (id=2801): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xd}}, 0x10) sendto$inet(r1, &(0x7f00000020c0)="f72bacc3ca1a9edf08e239411cbcf4", 0xf, 0x0, &(0x7f00000004c0)={0x2, 0x4e20, @multicast1}, 0x10) readv(r0, &(0x7f0000000500)=[{&(0x7f0000002100)=""/4076, 0x18}], 0x57) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f00000003c0)={'mangle\x00', 0x2, [{}, {}]}, 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r3) recvmmsg(r3, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000001a00)=""/4117, 0x1015}, {&(0x7f0000000800)=""/167, 0xa7}, {&(0x7f0000000400)=""/210, 0xd2}, {&(0x7f0000000780)=""/119, 0x77}, {&(0x7f00000000c0)=""/18, 0x12}, {&(0x7f0000003c40)=""/4083, 0xff3}, {&(0x7f0000000100)=""/128, 0x80}, {&(0x7f00000018c0)=""/145, 0x91}], 0x8}, 0x80000000}, {{0x0, 0x2b, 0x0}, 0x5}], 0x5, 0x40008062, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000600)='./file0/../file0/../file0/../file0\x00') r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x4}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000440)={r7, 0x9}, 0x8) 9m49.785418205s ago: executing program 0 (id=2804): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) write$cgroup_devices(r0, 0x0, 0xffdd) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x48}, {0x6, 0x0, 0x0, 0xfffff14c}]}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000480)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) syz_emit_ethernet(0x3e, &(0x7f00000004c0)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x3, 0x16, 0x30, 0x66, 0x0, 0xa, 0x6, 0x0, @local, @loopback, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x3, 0x13}]}}, {{0x4e20, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x8, 0xac0, 0x0, 0x400}}}}}}, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmmsg$inet(r8, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f00000005c0)="ca", 0x1}], 0x1}}], 0x1, 0x24008804) sendmmsg$alg(r8, &(0x7f0000003b80)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}], 0x1, 0x10) sendmsg$NL80211_CMD_GET_STATION(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x4000) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) 9m49.520602695s ago: executing program 0 (id=2807): socket(0x40000000015, 0x805, 0x0) socket$xdp(0x2c, 0x3, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfe, {{@in6=@private0={0xfc, 0x0, '\x00', 0x40}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x400, 0x0, 0x0, 0xa, 0x60, 0x0, 0x0, 0x0, 0xee01}, {}, {}, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4000) r3 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4054}, 0x10) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) 9m49.15102991s ago: executing program 32 (id=2807): socket(0x40000000015, 0x805, 0x0) socket$xdp(0x2c, 0x3, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfe, {{@in6=@private0={0xfc, 0x0, '\x00', 0x40}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x400, 0x0, 0x0, 0xa, 0x60, 0x0, 0x0, 0x0, 0xee01}, {}, {}, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4000) r3 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4054}, 0x10) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) 14.105618893s ago: executing program 2 (id=4730): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000032f44910c0090102a40a010203010902120001000000100901000000e5a5c800"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000300)=0x3) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x124) pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000640)="00214717a70700080000030600710a5e31163ceb9d047120000000", 0x1b}, {&(0x7f00000019c0)="67e41dc05fcc19cd91f207287c91401927943a2800a71e4caf8da35f3a38968066cdb96896809c8253989405f140d8f98189c3716059c87c41e787452c4ebe6733fa17b537c82b95553a02dab20757f791df163a1351bd6acf2df7861e0e0318c19053fe0c8001afcc497c673466f138b4da1abf4963e866d88489af1f403ce228636b897b1f2bd7f69fb4733944e9b0abdaac24c05dfbc583b5998e052b91b936e20b45c86ccac97c14a4548c2f84fe8f6b8088962291878f272fa1c3049711d293ade08843952870706656cda7", 0xce}], 0x2, 0x3, 0x2) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, &(0x7f0000000700)={{r1}, "b8155494ed33c8ba20927effad8f200daf7ea9c4c8bdd73b675635fcc5bbefccc0df962974941b4e7dd30ad930a9a68f82b64dcece217b4d454b93ff33055e3aec8ffd0804c3cecb1f0969e8794947b330e490829b535e2fa18b1b99917e6d895fb06c7bd6a20f463d28729b0d36e038aed87d04408e339b430baec8432f3b2768009f13bee80ba7646dca8c297916974e0d36bf073724a11bbc7ca287e8ba73205d6060f51c1571057a28d3d283705bff32c8ae9f2108052a49ea93898906206f5624734b4833fa071818eee09ddba31bf34300013893dfbaa208e0fff3f6a82e0772ded6740fc1caec072fa55a850502fb606d82e77603caa8b4a857857237c52ec6fa53746988c5c831eb77b4ebdffbe6e1e15d7c896ace24af3f95dab72b59dcb9e23c48cd24ee36736064221b28dec03cb4d5f7c5403070174d32ffa9262c225cdfbd589e8e267e1dc71725afa13740e08e999c526fbf9b6fdad1ebde9fc984216a0f093275c0f37b9cbbbece696c41c6a82247d8bd104ab2446b7d0930d39d5f677cbbd855259c1a19ea9189c917422aa62834aae9fdab16f146df5e70721c084c3cda6dfa3038b6302bb0e5fc8d322716fc43f383d97089e335acd51507aaaf8c52262d528557d826d16d7841a267b83c6351da2bdf993c2ce31b39b5867202c8bfba2100deb45030f3c131d0e58d9958d9144a4989e23edd2a7d24a45269d338d70f3eb2cef95821f4be16916c245b6cdac4a7432b621bc25f558bbaaff441b5178f754aa3ccdb233d257e921fbdec7f1c6b8b77d7b374725a0fef1cfbec92a7e4f83a18e1ae7698eee250c5f8e1d3cab7d55678b124bba6ddefc968b68bd5cdc2625772013d9b1d6af1f98e1e7349ea27e64599ccf5ef4157aa8b8e48026b3a3c3d9555901b23e3ed110d8be6206c2d89f7091da0b89b4e1f49cc7659154a2e69f6ffc9f36794903b8d928e54039fa49f9b090f864bd147ae983945adf9aefeb80b8931ab4b0b961a15e484ed85afef1a86c2705d33201b550d94e141427b77246ff83e99a92666a6fab287c2bd320a00e45c3dbc5b56d818ad34512d45ed8f75ee8550c4b1b610609ad923d61b18725ae01469fbb88de2aafbdf85e89197a6b50dbeae5b4350fc5f3af9a7aef3f542edab6e30edabacdb1633ceac99929bc3f42b2d5663dee219cde015f1185b59158e5bfb04c19557cd1e601a16f3bedc273f215d1c40e20f335bc8cec54e986c32494bcc2596b17d30f7221d526ad7558533f50b33d04056546373d36a4f85b74132017dc5c6a76856e297383aad42ff298627862f9cbd7fb273ceea03b63aa3e4cbbc66bf656341667b192d5c13766daeaed210ca0202e78c057c01a68773a1d04690c89a7c5e9076142345b8214ded2babf3dbe70c784d0baddfd7ac236ce8a3abcf59f5eaaf9b6d46046a24a4cb096ee46ddf8c75728b8288fea9c284555be9d269715ec04d95ebbc35b0e0ce85a76a9988329ac0d4df5e4f233c82eda0cdfbf88f399d489870341799f08019b1bbb4fd0fab4de53edb9f9c4804b33933ea75d73f75b639a1bc0c97f184675aeb943124cd0dcafe1ab64b8c34f2873a4f2ab6ebe664897f5ca46f89e6837eba8f4d83c1bf966ff172d4bb5676b43c0f575671f1be6ce2e644b2b1635290ce57e12c9b396d1a5f743c405738335c301b810cb7ffdda0375357645da23d36a18e8b076547222f68fd0080ab5775a84bcf5d619595f36bddbff1433f37910b4aa9f2addd0ddbe659b59f417e8821af2bd98d7a7623b4117ba0a8c66c547a5531c16e9b529aab994d5c7f3fd7fad893bf28446fa909ee7c65d847ba3a1ac14357bb325314f55b9a1daacce4af00a0b99e667d75c2f05bf890cde0f0346ce4057ec46917f26af0cdd3476fff172eca21b23d4bbcbc98594c68a83c16f44dd19a32f826c260635c8f3968efb11ca770155b83735def11393609838bfc61476bbada18d2f5dfc4aa95bfcdd05904a9828d3271afd23b2e30f0841b9e4debef24224ecfab1a4b9d1e14d0c1c95d80917844a82ab1f6bbf63572dcf4cb095eb752494feff8a84cd95cf9e019638bbf2670038539fbbe51b11347c5197b3178cd74c7132225e3948aa1273b1e1645a7b30afb5acf6034e0df8ba1ac011ef62315c15c5d6ed9b7019ea9e4ad38205a393b3e7e0b6b6553660f016bffb09ee5bbf12835a73695f21e7b1ab87f68bfd4bfb61b68caca5d0299a5bef5167b3a42f8d34659dbeb53a821b6cc4305081beb9e13439028eaad0dc2c1c3e6b882e3dc451b99eec57e47baa02977e5c2db34be9ef2f7931e87541095c9d5bb5086fdda6d525751e3e02bddf67744d3f7dd62ea4c8483eea77ae5cdee6ffd48dd583d04719d9903a6e42d63cf4ada7dd6c2f73eea34f3d75c81ba20f18a12d54e717dd5f57216e09f93bee21b8904ff70f6ab179693aad9839f19ae94323de5793dbed214a5aaefbd15877e801148833938ee3688ee81b1d76a7996d453f6830e80d1c7a9f943d9523cfbfc6e4df9ea16e941752e5771f278df7b91b6de3ee037059c7dfc7672df0d9772cb9a883e6968ff314a3d3099730404972a8811e6f87870acff0b51c26511bd783a10758b17abb6bdb8cb1a8372326965c9cbd5c747e3aece883f18697452978500a76e5a104337c2bad71daf591609eef0c48fa6ddbd09956ed860364e4f50db6806f063f2651c6aaddb0e0cf5b76156eece5270d4a1d8ce9756308902b31192d737de3dd08f4d5754333bbe4c40f2a0e9fc2997432612d8eb8bbcce25d083441a844d1a4b3d3d239a7c6587716412f1adf454bf0d83fcf30c5e014d85f25695f9723fc7fdb24996c27c9732dc616ce8c2adb001cc9ed886da26ac11cf818385c534f368c745d7de5159223eec030433b7f3a3bfd5dfe1f3a02d81a0c1e17088c76a13d81ff99b905ba36d79f8190856c47caed00383e431a917b2f8ac962ae72bb5293922168fb653b2164c1d3571f158199c173818c9ade1ce8c76e0e00c21676874ba7480030808c37e9774dfb7ebeb0fa9d959c1e11c7dab0053568facfc0c6bde4825457ddd5525f4c80118ac53750dc5e67a6ea05f63812268e8e00a0977a49a9575dcbcc46caa9ac1b2ec601e5599fbc5f553732a9c70cd2a84cb88ac4113740f591e5ad077de824fecad2494d9e359096ad23a1891ecd4b66b528ff0e7243828b7eae5e73f91e2eff400d72383687087a555f04e085f169ad9c18ed0b80d882ed78e9516700e19846e513ba4764f47c9b638c3acd3c36f02de80c1e74e40f7a330cc8bf98933d75b2460fb1e1cf9a8f8515cb76da5014e5d370ea087d6d5c5310a3c711bb9989963d01710c0bc7eacad47a2e756604df6ef9f59306e5fa513872e215a3edc383f7feec05b9dd745a654f2791c81057e365da40c528285744d124259f22b59ae4573585b26d7841e52d7c196f17de9a6e75adabf91e764eb99dd91312c592a7d04949b5146d4d54d6be27924aa450485140f134a7161c6c3f40c082c152d02ba1f26418eb97870d1b952cc63b4c9a9d715d19e3d898d9aca474c6e863de8f49ff8c96ecca87dbe3a940dc98fb97c3e6f1be4a20692af5b62a54117f2ac4581431e63dbcb6178cde1a5cb54ea6781a22cdc3f54f1965529c46a9306f35b5d29384be167f0716fdba20004262cbf98588a805c4d7af5f4905bc1a6ab9bf379ea3d332abea3f6623586d791d0e3c24c4166a969e5549cd5f5b0e673f21f8038af828be3f3a38ce8610364e9660f14fa6b5dd800605e482207eb1ec54e8d0a782473f82e76ac6216ff33445195268b9c430ba7f10a8243518cad5775ed504d452ffff3048f4cb0e9000002d1f65ade0d27b7f4e575a773ad3d4a07df627d2cb208821c88efca355d706f9d4ecee94993d9020d76b5ed8ac5e44f19df984a400aee9ea016ea4b91ff9b60b0c2bb0fe5a0691608e0a979d61f2159d00ae986542527d831cdd00324e74957279a948a1d49b64f6da22e6478a28b41f0ffeaafbbde60257cc9ed79866f3983cdd465410ced49fdefb633f6e0599314cbb7ef0c13fe293a7a755c259e795d00e366fb9be9fbd900d80ceb4d74ae70bdb5af2065fa325a5bea18bb20f812253d799dabb6cb53fc1f856963b48ada2858a694b6f2099d2d43b9fd615b7d651cb0e36f2205fbb07973d02f3c173339ecc4644f8d07414535dd6f77081a43ffd0395a9f18d5a6ad9226ef935ec0ba108f148830f25098bb456636e2a5d0444bf2e39ff9597ffe32313fe0c095414dbad1be81dfa8c115a2421e7665d1dcc50ee43726da7589c72ab1d6f97ad57b32f5ea343d41f4e768101e6daba332f04eab6c8c3c4a2e94cb58ab3be744184264eaab3d6330c7aab71f03d575af30e7dce8734593bd629f7864b675f61b067706213a80cf3c5ba329008d42c65d83db749f9328229447a889516e451f1d7beed5fadb0341fa59a8e16b3ff863b4d84dc5418f15890a9987e79c5f379b3e0a517621d78fd07f900713f58c4700ec5ad424667d285ccdc1758a6127ad9f077756500dc1dd568f0a167fe5edad9d8fd3337968c0c3553432505383abdf4654cca4f038b0b7ac4dbe980d56301d09e237eaa91b14f3feef40064a04191e679741eef34c3611a9ed8664f823a62a6e576df8584cee16101706335d58aee90f80e7142d52bc3bac142ac3cff72aa4da89c6866433f6ed05339bd3f58fc71253204aa59d8bf6736c9ec75b47d4dac8c4d70f4d9fd559488b3119103e9021104b2b9cbbadc1388d242b07a3a96603568be0669876a181ea438b4b41439217952370d75afb95f964320b1b9cceb02a9f12f0219fd61e51029ed68477f297baad9a921850f050827f1473b9546647c1dc0188b790c1afa4a56436c09df55df37cfe34e33a2db77b48e04bd9d574b49ca222fc2d16cfad0ea444522bf41259e6c5ba89dc47e1ea267573759a2d83aede95f70275c4b71575295458038aec0976b6876c97c2c5d173bb88b4e14aa37847d21cc8f2be5310fc1a80ccf381147196775aab6ea131451053669d1e487892351e61189b2a14fe8b17dbc4e9d171611d193839498197f3477e1ef883348e3bf6fef5f8f18ef0906f956cc61ec58d7814bb895a185c087193db2833f32fb380af97761d0762ca91f85e679ab5cfcd5a3cfcd1605b988d60d6be2b3773b4516100c23856602505672235ae619fe7f479ec12e42b32858a825bb53265803c96f56d305ccb7af5396496163d771231b91cbdb8f708ffbeb1fb3074e1bfd9ea9d82a0bada811057dac1df9ddd28f46227e3f9bbbf9eea0210abb14f9f9efb0c5f52514a7992d7a1887100af7f0cfd82c9e2e679d40153ebe68ea546a9e5601780795177a3e141bc2943fad0884a296babcb26e7da941f43cc15ee53a98be37267011f34062ddee80af108658898ee72cb23717c732dbd8b63c4b53764995df727a27f27fc7023f29cabe7456d5ffece38a75a5d9536e7e5db27a11882f32a16e934a38212f65271a8f687a3f22f6750876269bf175d3135b487cda473925e84c6f8ff178598e7c0cb844edbf1c70a6844197453e282fcfeb1fcdb8fd475bce6bbcf41b1e9f378d25be3cbe7e74c76becdb706b85cf98727b671f1ba42441abc98bd7248985da0765f33e673002d011d7db517c42ab1db0bedd42612a9f9c4c21352830cabe03dc12062ae4f262315eda31affecdc92e3c7f20bf11423386163c98bbee7028b91159b8b34097c6a8255"}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000006c0)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="000501"], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 10.773387042s ago: executing program 2 (id=4739): socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fspick(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = socket(0x28, 0x5, 0x0) setsockopt$packet_int(r3, 0x107, 0x10, 0x0, 0x0) dup(r2) ftruncate(0xffffffffffffffff, 0x200004) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000000)) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000ac0)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0xf8, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xd8, 0xf8, 0x60030000, {0x0, 0xff000000}, [@common=@frag={{0x30}, {[0xb, 0x8], 0xcdc, 0x4, 0x2}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x1c8, 0x230, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x3, 0x1, 0x0, 'syz0\x00'}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) socket(0x400000000010, 0x3, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$unix(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) recvmsg$unix(r7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x0) socket(0x2a, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c01000013000500"/20, @ANYRES32=r8, @ANYBLOB="000000000000000014000300766c616e3000000000000000000000000a0001"], 0x11c}}, 0x4) 10.528680188s ago: executing program 1 (id=4742): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x3}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}]}}, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040ed5000410"], 0x11) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(0xffffffffffffffff, 0x8) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x9c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x6c, 0x2, {{}, [@TCA_NETEM_LOSS={0x30, 0x2, 0x0, 0x1, [@NETEM_LOSS_GE={0x18}, @NETEM_LOSS_GI={0x18}]}, @TCA_NETEM_RATE={0x4, 0xd}, @TCA_NETEM_CORRUPT={0xc, 0x2}]}}}]}, 0x9c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000020000103000000000000000002100100000000020100000008000200ac1414bb080017006f204e220800040000800000080001"], 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r3, &(0x7f0000000140), 0x4924b68, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010042ab31aa35003d37d840890457802bf9776eb1e960f7a86647299b8ae0000000000001290224000300"], 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000200)={0x0, 0x0, 0x1, "e9"}, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1808000000010000000000000000000049760000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000550934e6d8b7e9f5f5a6d34d25b5175f0100000000009500000000000000be9800000000008c90800800000000008500000007e7cf9f2b312a008c3df3f0c6"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) 9.526084149s ago: executing program 4 (id=4745): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xe7ac4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(r1, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (fail_nth: 8) 8.777345284s ago: executing program 2 (id=4747): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d67c8002a000009050502000000000009058b6e", @ANYRESOCT=0x0], 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) ptrace(0x10, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGSKNS(r1, 0x894c, 0x0) recvmsg$unix(r1, &(0x7f0000002ac0)={&(0x7f0000000480), 0x6e, &(0x7f0000002980)=[{&(0x7f0000000500)=""/137, 0x89}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/175, 0xaf}, {&(0x7f0000000400)=""/48, 0x30}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/137, 0x89}, {&(0x7f0000002740)=""/251, 0xfb}, {&(0x7f0000002840)=""/56, 0x38}, {&(0x7f0000002880)=""/236, 0xec}], 0x9, &(0x7f0000002a40)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x48}, 0x10042) msgget(0x1, 0x2b0) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0xff, 0x56a, 0xf8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xfe, 0x20, 0x3, [{{0x9, 0x4, 0x0, 0xf, 0x1, 0x3, 0x1, 0x2, 0x1, {0x9, 0x21, 0x2, 0x1, 0x1, {0x22, 0xf65}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x95, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x2, 0xa, 0x15}}]}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x50, 0x7, 0x8, 0x53, 0x10, 0x10}, 0x9d, &(0x7f0000000100)={0x5, 0xf, 0x9d, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x67, 0x5, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x7, 0xf2, 0x81}, @generic={0x76, 0x10, 0x3, "cb42623b8f4b3d257795b23a5c11b00d778bf7fe93454d994ba153de620c97eecd27f96e68d61c3fe9d8188c5103a615e53737f234fa75dff56478d95a0a78b1a39fe3ac3209eadfa365e7067ea1f188554c9259bab1836fbac41e7f8d2d6ba0eb327b0b7a111733f705070a7c95745f632ef5"}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x8, 0x9, 0x7, 0x40, 0x4, 0x5}]}, 0x2, [{0xb5, &(0x7f00000002c0)=@string={0xb5, 0x3, "dff459bf50d40a18f3ae141808547388dbfa963c6f5192919ce624ac39e199d8995a16b46db2f8162a3e5232f7070ac9be1827833e3343a3c444fa8a820530961cdc67a71b86bd9562321e386a77d5c5d82fa6fad4c483f993035a080d6c1c85429edfdf3280065d7f9f25bf10ecba0beb5ff82eb96415129980c0d4616d5adbf3b093fab31277f00ff935ccc9523289f7d36966c4cffdcebd5cb1d6b48cfbd933621447ba17954b1f7fcc30d0fbd661802461"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x443}}]}) msgrcv(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x2000) socket$inet6_tcp(0xa, 0x1, 0x0) uname(&(0x7f0000002b00)=""/186) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000440), 0x189040, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r2, 0x5201) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r3) close_range(r3, 0xffffffffffffffff, 0x2) syz_usb_ep_write(r0, 0x8d, 0xfb, &(0x7f00000001c0)="d0be166e5e8b26a5e6b39aa93e00d43ec7e813e40b8fcad530f5176b71ef3ac478184911afdd2a979d4c5b7fccca3f0c6871b5032e4727642967374587861ca6bd95847cd7fa48e161817931a074a00f2d99471f511f07fc4bd392b89c581899e2ae79abe551ecce24444d0d91595054bea9bb0ce5ca2985043edb126c403549e7c5d36ceba659a4acb46b1361f31359c9f1c4b02f5edbe98e11edb32d0c08ce4e024fcefdee253f92ee9a9acfc0642ca6543d7ee1bab1") 8.059893389s ago: executing program 4 (id=4749): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x2) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0)=[0x0], 0x0, 0x0, 0x0, 0x8e, 0x0, 0x1, 0x0, r1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) io_submit(0x0, 0x1, &(0x7f00000001c0)=[0x0]) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x160, 0x4c, 0x2500, 0x290, 0x73, 0x290, 0x258, 0x258, 0x290, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x73}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'vxcan1\x00', 'team0\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) r4 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000300)=0x7) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000080)={0x3, 0x8ba, 0x4, {0x4, @win={{0x6417, 0x69f20258, 0x8, 0x8003}, 0x6, 0x1, 0x0, 0x8, 0x0, 0xc4}}, 0x9592}) shmat(0x0, &(0x7f0000ff7000/0x3000)=nil, 0x400c) r5 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000002440), 0x2, 0x0) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)=@generic={0x0, 0x0, 0x18}, 0x18) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000008, 0x110, r6, 0x75bd3000) ioctl$VIDIOC_G_FMT(r5, 0x40045612, &(0x7f00000016c0)={0xc, @sliced={0x6, [0x9, 0x0, 0x9, 0x1, 0x8000, 0x9, 0xdb, 0xffff, 0xa8de, 0xb, 0x1f, 0x5, 0x3aa, 0x6, 0x3, 0x7d, 0xaf, 0xfffb, 0x3, 0x109, 0x4, 0x4, 0x1, 0x7, 0xfffe, 0x9, 0x8000, 0x35, 0x4, 0x9, 0x5, 0xb8ec, 0x5, 0xfffb, 0x8, 0x1, 0x100, 0x6, 0x88, 0x6, 0x611, 0x10, 0x80, 0x3, 0x8, 0x26, 0x6, 0x3], 0x9}}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff6000/0x4000)=nil, 0x4000, &(0x7f0000000080)='\x00') r7 = syz_clone(0x4200000, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r7, 0x0, 0x40000000, 0x0) r8 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r8, &(0x7f0000003980)={0x2020}, 0x2020) 7.383738492s ago: executing program 1 (id=4753): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000400000001000000229f"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r0, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040), &(0x7f0000000380), 0xffffd6bd, r1}, 0x38) 6.957565594s ago: executing program 1 (id=4754): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{&(0x7f0000000040)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000000740)=[{&(0x7f00000000c0)=""/83, 0x53}, {&(0x7f0000000140)=""/175, 0xaf}, {&(0x7f0000000240)=""/85, 0x55}, {&(0x7f0000000300)=""/253, 0xfd}, {&(0x7f0000000440)=""/226, 0xe2}, {&(0x7f0000000540)=""/205, 0xcd}, {&(0x7f0000000640)=""/158, 0x9e}, {&(0x7f0000000700)=""/54, 0x36}], 0x8, &(0x7f00000007c0)=""/9, 0x9}, 0xfff}, {{0x0, 0x0, &(0x7f0000001880)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/88, 0x58}], 0x2, &(0x7f00000018c0)=""/208, 0xd0}, 0x40}, {{&(0x7f00000019c0)=@hci, 0x80, &(0x7f0000002f00)=[{&(0x7f0000001a40)=""/4096, 0x1000}, {&(0x7f0000002a40)=""/139, 0x8b}, {&(0x7f0000002b00)}, {&(0x7f0000002b40)=""/170, 0xaa}, {&(0x7f0000002c00)=""/133, 0x85}, {&(0x7f0000002cc0)=""/138, 0x8a}, {&(0x7f0000002d80)=""/66, 0x42}, {&(0x7f0000002e00)=""/252, 0xfc}], 0x8}, 0x7}], 0x3, 0x12141, 0x0) 6.804898829s ago: executing program 1 (id=4756): unshare(0x68040200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000340)={0x7d, 0x40000094, 0x0, 0x0, 0x0, 0xfffffffffffffffb}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) unshare(0x22020600) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, 0x0, 0x0) r3 = dup(0xffffffffffffffff) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000040010000"]) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) fcntl$setstatus(r6, 0x4, 0x2000) read$FUSE(r6, &(0x7f0000001540)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) unshare(0x20400) pselect6(0x40, &(0x7f0000001400)={0x7, 0x1, 0x3, 0x7fffffff, 0x4, 0x83f, 0x4, 0x7}, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f0000000940)=[{{&(0x7f0000000540)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000000800)=[{&(0x7f00000005c0)="b11e52583a314cdeafbff23f5b0576d4d6bbbbe34f3a1c83cc34f4f46086c5259aabb8a116392bef21b3e74e4a1597be2541c442feafc2c4c6808d9b2b9a7c75ba23b9cf43e7bbd3b9a4c10472553762d7f1129294cef7abad4a275d823aef892eba1dcb080fd9e3205192ae", 0x6c}, {&(0x7f0000000680)="07cff51ecdc37394a7fa99b6547692672b91ba59d44c043379c24c5def73a788a5ef3e577c37225ad758dda98213b920ba96945a01bca6f382add41405b9c5dcd042241aaee69fbec1cc029d380a93f5e2481f0ef23350184c85eb5702c999b609381a0f187d21cd5c2a199ce520dcbf417f86393b8d4e9c6f8f98ce05610af711b1ecdbf84defe95f06f8", 0x8b}, {&(0x7f0000000740)="1c3867236ffca03f28a552041c924cc25ba2b6472a5cd8885bc638a52aefc7df35149727b94c93c4bca7338f00a908984582d7ca0713fc004a88c7bc0b3d5042aec320b73102a9e7d7e465b2", 0x4c}, {&(0x7f00000007c0)="1b830c02274714a35e4c2e4e1bdd1a5b8f8102ede0d0e89b4e1799415c2d3877295f0aa81d9d719835c938", 0x2b}], 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r9, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r5, @ANYRES32=r11, @ANYBLOB="0000e3001cf7ffffff000000010000000100d7b685414e2d71596bd0fda6d071e61b0000", @ANYRES32=r11, @ANYRES32=r11, @ANYRES32, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r4, @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0x80, 0x400c800}}], 0x1, 0x844) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000080045000044000000000021907800000000ffffffff050090780a0101024a0000000000000000000000ac1e0001ac141401071300e000000200000000ffffffffac14140c"], 0x0) r12 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFMT(r12, 0xc0045005, &(0x7f0000000640)=0x8000) r13 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r13, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private2={0xfc, 0x2, '\x00', 0x1}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0xfffffffffffffffe, 0x41, 0x0, 0x0, 0x1000, 0x6}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x200}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) 5.565043801s ago: executing program 2 (id=4760): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002640)=@delchain={0x5d0, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x574, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x544, 0x1, [@m_simple={0x1fc, 0x1e, 0x0, 0x0, {{0xb}, {0x1d0, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x142, 0x3, '\xd5\xe9Ji\'\xc9\xb2\xcfE\xcdRO\xbd\xfd\xc8\xbd\x9f\xbb\'q}qqx\xdf\xf8\x82\xfd\x1c(\xafU\n\xeaP\xa1\xf3\x92\xa9\x16)\xb4i\xcf\x81\xb4\x0e\x8a\xa0Ou:\x18z\xad\xb8\x97\x038\xbd\x12lw\xcb\xea\xed\xad\x14E-\x91U\xa5R-\xb5\xb6\x0ehba\ar\xb0N\x9ek\xff}\x00\v\x86\xe8\xd7\xd9\xf4\x1a\a\xb3\xce\x1d\xe3fI\x1f\xdc\xab0G\xc5b\xa3gF\xd5\x9f\xde\t\xcc\xaf*\x90\xea\a\f3l\xf2g?\x9b\x96\xb2\x9b\r\x98\x83\'T\xc4\x810]\xbf4\x8a\x10\x92I\x19\xa5\xa4\x90\xe9u\xc2\xf7\xed\x15\xf9\n6\x98\x85\'\xfb\x00\x00\x00\x00\x00\xe8\xa54*\v&\n\xbb-\x81\xa9\x91E\x94\t\xdew1^hZ\xe5{\x1f\xcb\vzG&\xf1xj\x10\x020\\\xde\\\xdc:\x8aL\xd1\x0e\xbd\xf7F\xce\x88\xd9\xd9\x1a\xc7\vD.\xf9);j}\x8fRY\xae\x01\xeb\xbduw~\xf9\xd1\xd1\x85\xa0\x16%\xb1\x97f\xca\xf2=\'\xb57\x94\xff\x92u\xb8\xa8\xect0\x1d\xb8\xd1\xa6F4\x934M\xe2\x9d\x94I\vf}U\x9f\xbcq\x92\xe8\xd3\xfe\xa3\xd7\xb1\xe3gi<\x00\x98\xaf7,\xec\xca\xfcU\x9f\x83\xb7\xec\'\xde\xb9\x10\x86\x93\x18'}, @TCA_DEF_DATA={0x6, 0x3, '-\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x40, 0x3, 0x20000000, 0x7f7, 0x2}}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x587, 0x5, 0x81, 0xa}}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x2, 0x20000000, 0x8, 0x13b}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3304, 0x7, 0x10000000, 0xf65e, 0x1}}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x1, 0x20000000, 0x2, 0xd}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_simple={0x38, 0x1e, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x8, 0x3, 'bpf\x00'}]}, {0x4}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_bpf={0x138, 0x13, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x6, 0x4, 0x1, 0x7}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}]}, {0xed, 0x6, "144d833505e6ef200c20ad2f4ee5c4c2e9f89f0445fba28aca82e7ca2726936d4c717387fc4d2c19168e132d89cb085c4d3f67b08606cf6a0ee5ae00947ff1bc110f7d1c9127ef2557d327af84971cff93750a0a8b0ae8bac7172de9d4238ad596e55b83399a52c605793166c1a5df60a955a53ffe106b9a9539204b0f6e1e616f5bede65b24928c8006419cafe78104617cd7cefd6ddfa266d7eeabd4f247a9a8b3fb7f305b5cefcc033a61ff87294b69eff857bacab41f7d6dd43b0ae9457814ca1daf60f1ee05ebf4b276f9b2b63c5d3cfab7d6663084b4a459c0d4996f9af5d713152a5ef9c5bf"}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_connmark={0xec, 0x15, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x4, 0x8, 0xc, 0x8}, 0xff21}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x2, 0x20000000, 0x1, 0x6}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x1000, 0x20000000, 0xcdb, 0x305}, 0x5}}]}, {0x65, 0x6, "726786f34dc39a3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaeded7fbb0c799f243d3827c1ff7060f9d56b77b6373212745232c734d9b45311b3eceeeb16cae2bfd77942d880d60c94991d896d67e1bf08b6ace5ba70ca"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_csum={0xe8, 0x8, 0x0, 0x0, {{0x9}, {0xac, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x1, 0x2, 0x4, 0x3}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1000, 0x2, 0x3, 0x3, 0x9}, 0x4c}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x503e386e, 0x10000000, 0x3, 0xfffffffa}, 0x34}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x200, 0xffffffffffffffff, 0x3, 0x4}, 0x62}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xb, 0x1ff, 0x10000000, 0x1, 0x1}, 0xd}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0xfff, 0x7, 0xfffffffe, 0x154f1214}, 0x7c}}]}, {0x11, 0x6, "4ac6768e05c6ec90b23e3707aa"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}]}}]}, 0x5d0}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'veth1_to_hsr\x00', &(0x7f0000000580)=@ethtool_per_queue_op={0x4b, 0x1, [0x3, 0x5, 0x8, 0x6, 0x4, 0x7, 0x7f, 0x7, 0x7, 0x800, 0x7, 0x2, 0x80000001, 0x9, 0x3, 0x3ff, 0x8, 0x4fe, 0xd0f, 0x0, 0x5, 0xbc14, 0x80000000, 0xffffa0ff, 0xfffffff7, 0x2, 0x7, 0x8, 0x8, 0xfffffff7, 0x100, 0x456cf931, 0x4, 0x4, 0x9, 0x6, 0x5, 0x8001, 0x10, 0x6, 0x1, 0x6, 0x7, 0xd, 0x80000000, 0x400, 0x2, 0x1, 0x9d, 0x7, 0x2, 0x9ae, 0x0, 0x5, 0x3, 0xee4, 0x5, 0x0, 0x1285, 0xa, 0xf, 0x8, 0xb, 0xf, 0x0, 0x1, 0x3ff, 0x8, 0x5, 0x0, 0x5, 0x8, 0x9, 0xe, 0x6, 0x7f, 0x8, 0x3, 0x2, 0x3, 0x4, 0x7f, 0x3, 0x1, 0x1000, 0x4, 0x8, 0x7, 0x9, 0xb5a, 0xa, 0x2, 0xffff, 0x5, 0xa, 0x2, 0x5, 0x1, 0xffffff7f, 0x6, 0x8, 0x1, 0xffffffff, 0x9, 0xc, 0x8, 0x18e, 0x1, 0x1, 0x9, 0x5, 0x96, 0x3, 0x3, 0x5, 0x3, 0x80000001, 0x10000005, 0x6, 0xbb3, 0x6, 0x101, 0x9, 0x6, 0xcd68, 0x9, 0x81, 0x41]}}) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b0000190007800800030000000000080002000000000008000300000000000800020000000000080003000000000004"], 0x7c}}, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80880) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f0000000040)={0x0, 0x5, 0x6, 0x0, 0xd}) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000000000)=0x9) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 5.374080371s ago: executing program 4 (id=4761): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000)=0x3b85, 0x4) setsockopt(r0, 0xc, 0x401, &(0x7f0000000040)="084421e435bc20e90f19a7d714bda2c4f5fd901ff1f533d40300ebffdac6395bab053e08ae00746871", 0x29) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x28100) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000011c0)={0x257dd4a63d759a75, 0x1, &(0x7f0000000100)=""/5, &(0x7f0000000140)=""/112, &(0x7f00000001c0)=""/4096, 0x2000}) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000001200)) write$vhost_msg_v2(r1, &(0x7f0000001440)={0x2, 0x0, {&(0x7f0000001240)=""/219, 0xdb, &(0x7f0000001340)=""/244, 0x1, 0x4}}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000014c0), 0x0, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000001540)={0x0, &(0x7f0000001500)}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000001580)=[@in={0x2, 0x4e21, @private=0xa010100}, @in6={0xa, 0x4e23, 0x8, @remote, 0x4}, @in={0x2, 0x4e21, @rand_addr=0x64010102}, @in={0x2, 0x4e24, @private=0xa010102}, @in={0x2, 0x4e21, @private=0xa010101}, @in6={0xa, 0x4e22, 0x7, @remote, 0x400000}, @in6={0xa, 0x4e22, 0x3, @mcast1, 0x1000}], 0x94) r4 = dup(r2) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001640)='/proc/schedstat\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sendmsg$rds(r5, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/29, 0x1d}, {&(0x7f00000026c0)=""/20, 0x14}], 0x3, &(0x7f0000002740)}, 0x4011) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000002900)={&(0x7f00000027c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000028c0)={&(0x7f0000002800)={0x84, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x4}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x81}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xf}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xfff}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x5}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x84}, 0x1, 0x0, 0x0, 0x40810}, 0x4000000) socket$rxrpc(0x21, 0x2, 0xa) syz_clone3(&(0x7f0000003ac0)={0x1020080, &(0x7f0000002940), &(0x7f0000002980)=0x0, &(0x7f00000029c0), {0x1e}, &(0x7f0000002a00)=""/105, 0x69, &(0x7f0000002a80)=""/4096, &(0x7f0000003a80)=[0xffffffffffffffff], 0x1, {r5}}, 0x58) syz_open_procfs(r6, &(0x7f0000003b40)='attr/current\x00') r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000003b80)={0x3, 0xffffffffffffffff, 0x1}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000003e40)={0x0, 0x1, &(0x7f0000003bc0)=""/108, &(0x7f0000003c40)=""/248, &(0x7f0000003d40)=""/230, 0x4}) r8 = socket(0x1d, 0x800, 0x10) write$sndseq(r4, &(0x7f0000003ec0)=[{0x5, 0x9, 0xe2, 0x3, @tick=0x5, {0x1, 0x6}, {0x7, 0xe}, @raw8={"e8663151f0b0ab0dde71ee00"}}, {0x90, 0x78, 0x7e, 0x1, @time={0x2, 0x7}, {0x7, 0x10}, {0x7, 0x2a}, @raw32={[0x1, 0x2]}}, {0x2, 0x5, 0x2, 0x8, @tick, {0x7, 0x6d}, {0x7}, @control={0x0, 0x8, 0x80000000}}, {0x8, 0x10, 0xc6, 0x4, @tick, {0x34, 0xc}, {0x2, 0x2}, @quote={{0x4a, 0x6}, 0x3deb, &(0x7f0000003e80)={0x4, 0x5, 0x8, 0x10, @tick=0xf, {0x6, 0x1}, {0x6, 0x6}, @quote={{0x8, 0x64}, 0x10}}}}, {0x0, 0x0, 0x8, 0x2, @tick=0x2, {0x79, 0x3}, {0x0, 0xe}, @connect={{0x8}, {0x4, 0x81}}}], 0x8c) openat$uinput(0xffffffffffffff9c, &(0x7f0000003f80), 0x802, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r8, 0x110, 0x4, &(0x7f0000003fc0), 0x4) socket$kcm(0x29, 0x5, 0x0) mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000006) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000004040)={&(0x7f0000004000)=[0x0, 0x0, 0x0], 0x3}) 4.877575404s ago: executing program 2 (id=4763): syz_usb_connect(0x4, 0x2d, &(0x7f0000000040)=ANY=[@ANYRES8=0x0], 0x0) r0 = gettid() tkill(r0, 0x7) r1 = fsopen(&(0x7f0000000100)='gfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source', &(0x7f0000000000)='::,\n-&\xf5\xcc\xd7\x06f\xcdY\xb9\xc7\x9d\xb2a\r\xd7\xef\xc5\x112i\x88\n\x13.\xd6\xfa\xd5?\xc7\xfd&\x8d*\xbb\xa7&,\xe9\xa3\'\x91>C\x1b\x15\x87\xeb\xfe\x1c\x9d\\C\xfeI\'\xae\x8fKHq\x89\x83\xbb\x9dC\xd6Hy\x04\xa4\xb6\x88\xdb\xa1b\xae\xa7\x87\xcc\xc7\xa4\xdc\n:///\x00\x00\x00\x85^\x00\x0f\bu\x01\xab\x8c\x95?\x90\x8d_r\xe7\r\'-06,\xff\x84x\'+\xd5\xd4?[e\x19\xa3\\J\xe9\x8a\xb9\xe4r\x93\xb3\xd3J \x06\x03\xae', 0xfeffffff00000000) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, 0x0}, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x19) prctl$PR_SCHED_CORE(0x4d, 0x2, r0, 0x1, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x21, 0x4, @thr={0x0, 0x0}}, &(0x7f0000bbdffc)) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r3, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) signalfd4(r2, &(0x7f0000000140), 0x8, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, &(0x7f0000000000)='\t', 0x0) preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/4, 0x4}], 0x1, 0x8, 0x6) socket(0x1, 0x3, 0xc16) r5 = getpid() syz_pidfd_open(r5, 0x0) timer_create(0x2, &(0x7f00000001c0)={0x0, 0x21, 0x4, @tid=r5}, &(0x7f0000000200)) 4.777884302s ago: executing program 1 (id=4764): arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmsg$NFNL_MSG_ACCT_DEL(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, 0x3, 0x7, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x8}, @NFACCT_FLAGS={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x20008080) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0x74}}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000200000020000000d268000020d384d9cc014c894759a097d7590f093b7b669ffc6a92744fa50ffe061227fc59cf08000000050009058103000000000004680d42380adaa111a3b8051428b4b0d2ab512aab5383d8de97feab773a502fd5b47ee205b3fbe6681f76cc2ff90a631ab8fdccc18e88ed0c7d7c2ae80bd55c27f7fde22962649024736db16da00080399dbdfcad3167994d29f457b56607c3374528663fd66433ffe9a2d8956d175d382eea1079a278f1e5c027b20369b41419d796a0e55e054a04cfd9076043dbd0863bb96efc236beb1f99f20b504b1fca79e335d6a025399bf6b278d8c826669b9dc329d75d80ae9d1de0db232a44"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000280)={0x2c, &(0x7f00000000c0)={0x0, 0xd, 0x7, {0x7, 0xf, "9a768d208f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 4.43310009s ago: executing program 4 (id=4767): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001964d408861a92e03f530102030109022400010200100309041f0202e917f300090502020002020000090582020002"], 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200)={[0x2]}, 0x8, 0x80000) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_DISCONNECT(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r2, 0x10, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1d}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x8051) syz_usb_connect$cdc_ncm(0x1, 0xa7, &(0x7f00000000c0)={{0x12, 0x1, 0xffc279e2d4363c01, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x2, 0x1, 0xb, 0x0, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "338c53"}, {0x5, 0x24, 0x0, 0x7b4}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x7, 0xfff, 0x86}, {0x6, 0x24, 0x1a, 0x5e5b, 0x20}, [@obex={0x5, 0x24, 0x15, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x4, 0x9}, @mdlm={0x15, 0x24, 0x12, 0x4}, @mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x86, 0x8}, @mbim={0xc, 0x24, 0x1b, 0xfff, 0x7f, 0x6, 0x7, 0x6, 0x3}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x3, 0x0, 0xf}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x5, 0x8, 0xfb}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x6f, 0x8}}}}}}}]}}, &(0x7f00000001c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x201, 0xb5, 0x45, 0x3, 0xc147e304ebce48b6, 0x6}, 0x16, &(0x7f0000000040)={0x5, 0xf, 0x16, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xfe, 0x3e, 0xe}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x0, 0x3, 0x9}]}, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x437}}]}) syz_usb_control_io(r0, 0x0, 0x0) 4.178242736s ago: executing program 5 (id=4770): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) r1 = socket(0x29, 0x0, 0x3) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000000)='#!.\x00', 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$evdev(&(0x7f00000003c0), 0x742, 0x40) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x5, 0x0, 0x3, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x800, 0x0, 0x8001, 0x8000000, 0xfffffffffffffffe, 0x0, 0x4}, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000080)=0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x642000, 0x0) syz_open_dev$media(0x0, 0x8, 0x10b482) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000280)=0x2) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="5c00000014006b0300000000006c1d0010047e0c8131a6080c000af32c6e020075f800250002000f00e5aa000017d34460bc24eab556a705251e6182949a36c2d13b48df000000000000ecb8f6ec63c9f4d4938037e786a6d1bdd700", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000000000000554453ff301eca05000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320002000000000000060a010400000000000000000100000008000b40000000006800190480340001800b00010065047468647200a3f0b49a80080001400100000c080003400000000008000440000000220500020007000000300001800c000100626974776996650020000280080003400000000208000140000000140800024000000012040007800900010073797a300000000014000000110001000000000000000000070000", @ANYRES32=r5, @ANYRESHEX=r6], 0x104}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/cpu_byteorder', 0x42, 0x80) syz_open_pts(0xffffffffffffffff, 0x141601) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r7, &(0x7f0000000040)=0x900, 0x12) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r7, 0xc008551c, &(0x7f00000001c0)=ANY=[]) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) 3.997224868s ago: executing program 2 (id=4771): futex(&(0x7f0000004000), 0x5, 0x0, 0x0, &(0x7f0000004000), 0xab020010) r0 = socket$nl_generic(0x10, 0x3, 0x10) gettid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x40000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x2d) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x2a801, 0x0) sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2203, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0xff, 0x3}, 0x20) r7 = syz_open_procfs(0x0, 0x0) pread64(r7, &(0x7f0000001600)=""/4089, 0x5, 0x200000000000049a) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000080)={0x18}) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r8, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x40045) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a0000000000000000070000", @ANYRES32, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f3000"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000003c000701fcffffff00000000017c0000100036800c00020008000000007000000c000180"], 0x30}, 0x1, 0x0, 0x0, 0x488c0}, 0x4080) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000001c0)={@multicast2, @local}, 0x0) 3.480791073s ago: executing program 3 (id=4772): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000700)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd1}, 0x800) ppoll(&(0x7f0000001080)=[{r0, 0x107}, {r0, 0xe024}, {r0, 0x1ea239f3aa3161fd}, {r0, 0x1100}, {r0, 0x1008}, {r0, 0x2}, {r0}], 0x7, &(0x7f00000010c0)={0x77359400}, &(0x7f0000001100)={[0x1]}, 0x8) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r1, 0x3b83, &(0x7f0000000300)={0x28, 0x10000, r2, r2, 0x3a7f37, 0xffffffffffffffff, 0x3, 0xf32ba}) r3 = socket$inet(0x2, 0x6, 0x9) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001500)={0xffffffffffffffff, 0xe0, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001240)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, &(0x7f0000001280)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000012c0)=[0x0], 0x0, 0x77, &(0x7f0000001300)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000001340), &(0x7f0000001380), 0x8, 0x61, 0x8, 0x8, &(0x7f00000013c0)}}, 0x10) sendmsg$nl_route_sched(r4, &(0x7f00000015c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)=@deltclass={0x30, 0x29, 0x8, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0xfff1, 0xb}, {0xffe0, 0x9}, {0xfff3, 0xb}}, [@tclass_kind_options=@c_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x488c0}, 0x20) setsockopt$inet_MCAST_LEAVE_GROUP(r3, 0x0, 0x2d, &(0x7f0000001140)={0x7, {{0x2, 0x4e21, @multicast1}}}, 0x88) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r6, 0x0) cachestat(r6, &(0x7f0000000040)={0xffff, 0x10}, &(0x7f0000000080), 0x0) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r7, 0x84, 0x7a, 0x0, &(0x7f0000000000)) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f0000001600)={0x18, 0x1, 0x1, 0x0, r2, 0x4}) r9 = dup(r8) write$UHID_INPUT(r9, &(0x7f0000000040)={0xa, {"a2e3ad21ed0d52f91b38090987f70e06d038e7ff7fc6e5539b3244078b089b3407326d090890e0878f0e1ac6e7049b336d959b659a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec97a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f11f46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f1b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83cd06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803335ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c134b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3765b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b33c5260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 3.153250209s ago: executing program 5 (id=4773): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xe7ac4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(r1, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (fail_nth: 10) 2.877742495s ago: executing program 5 (id=4774): syz_usb_connect(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYRESHEX=0x0, @ANYRES32], 0x0) 2.802367023s ago: executing program 4 (id=4775): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000840), &(0x7f0000000880)="22cff58056", 0x5, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x40, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket(0x400000000010, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/23], 0x50) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000400)={0x5, 0x0, '\x00', {0x0, @reserved}}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x2a, &(0x7f0000000e00)=ANY=[@ANYBLOB="109fd1e9c4dcea4a13067ad9558173b5fffb1163", @ANYBLOB, @ANYRES32, @ANYBLOB, @ANYRESHEX, @ANYBLOB, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb7030000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$kcm(0x11, 0x2, 0x300) r4 = syz_open_dev$vim2m(&(0x7f0000002a80), 0x3, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000004c0)={0x1, @win={{0x1, 0x0, 0x47524247}, 0x7, 0x8, 0x0, 0x0, 0x0}}) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000000), 0x4) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x8011, 0x40, 0x32, 0xb, {{0x9, 0x4, 0x3, 0x3, 0x24, 0x65, 0x0, 0x5, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x34}, @multicast2, {[@timestamp={0x44, 0x10, 0x6f, 0x0, 0x7, [0x8, 0x9, 0xff4]}]}}}}}) sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000280)=@xdp={0x2c, 0xd, r7}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000380)="9e6bbf6efb4475aa7aa4bac403c30995a69ee5ceca23ec52fd86a4823ffd9855660b39045dfb8f269aef370345856d0d550be9448624ab84d63002ff5093f029d74ed904dbd877952582e58882552f9eebabc959a26e835710a1db929e554488eb617fdf4f8ad85b8f576278", 0x6c}, {&(0x7f0000000300)="85ba83f4317d8355e43d4ab77829c81b44c52879b0d2c15eb646da975b6df82f255e61b2fdad9cfcc739b7f9e792dd83f2e9c89638ffc9cb43e1c689c25a52", 0x3f}, {&(0x7f00000005c0)="d69d02b39518be498853f757bfad9ed04aa312617cee3718f52ec3a065c0ac0ccd5b0a8bc14a318b3055897aaecd79c4d695d68fddc36d48583284aa1b98aedc92d0a1ff5dce9ef4495806f7369243ed65b8d30769ce9fc0dce6a4bfa648f628b3b5133ac7209b6eb26fb0daaee6ba3249ae444865d42d7d0c5f5b43f3f625d59109501f17ed91dfcca208bd941e0f65f9144cdc97d8bb22b96d0e19b408bb889a6c5c6a90c349ea8e735958", 0xac}, {&(0x7f0000000400)="20ba0c2f49c82664c6d61183acf91bf815e4ffd046684d1f427aa3f1e1bd8df99e190685dad5ca11819658f4d2694c2b269124d1", 0x34}, {&(0x7f0000000680)="d8e59de2e2340fbb70777dd3825960403e87af81d4a7a591cbf57dfefdf6bc03206c36179f97ceb5af4e40588471bb73315d238e9e5366c34ed36662d0b032ef7b33b819bb9a19d2eb164454ddd622fa0268a014790a05c1b1861fd5622f4d6bc7ae24706a524d553e116eaac5b5a5998a38159bff752d5b26ac7c002fb540b881bb5cc13aa50a70aa1216e273b3cc1c5e9a6dd6c8baf22d5c7fbce636145f05b6933f8bc0cd5c3149319acc87d78ae60bf7ff37094ab1c9899f4d", 0xbb}], 0x5, &(0x7f00000008c0)=[@timestamping={{0x14, 0x1, 0x25, 0xf}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @txtime={{0x18, 0x1, 0x3d, 0xfffffffffffffffd}}, @mark={{0x14, 0x1, 0x24, 0x200}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @mark={{0x14, 0x1, 0x24, 0xffc}}, @txtime={{0x18}}, @mark={{0x14, 0x1, 0x24, 0x5}}], 0xc0}}], 0x1, 0xc001) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'gretap0\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000480)={r8, 0x1, 0x6, @local}, 0x10) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000040)={r8, 0x11, 0x6, @multicast}, 0x10) close(r5) unshare(0x42000000) 2.652202243s ago: executing program 3 (id=4776): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r0, 0x84, 0x84, &(0x7f00000020c0)=""/4055, 0x0) 2.513553996s ago: executing program 3 (id=4777): r0 = memfd_create(&(0x7f0000000480)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9', 0x3) capset(&(0x7f0000000340)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x20000000}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000300)="4800000014001d1009074beafd0d8c560a84606080ffe020590000a2bc5603ca00000f7f8907000020008d42188fedc22e47ad8f75edc6d100000101ff0000000309ff5b00000000", 0x48}], 0x1) unshare(0x2c060000) unshare(0x24030780) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000020601080000000000000000000000001400078008001140000000000500150002000000050005000a000000050001008700000005000400020000000900020073797a310000000011000300686173683a6970"], 0x60}, 0x1, 0x0, 0x0, 0x40094}, 0x0) pwrite64(r0, &(0x7f0000000040)="ab", 0x1, 0x2) r3 = socket$inet(0x2, 0x3, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'tunl0\x00', &(0x7f00000000c0)={'erspan0\x00', 0x0, 0x8, 0x700, 0x6, 0x4, {{0x24, 0x4, 0x0, 0x12, 0x90, 0x67, 0x0, 0x0, 0x2f, 0x0, @private=0xa010101, @broadcast, {[@generic={0x7, 0x7, "d6ec4a40c5"}, @generic={0x88, 0xf, "82269af6c9742d9a5f1a7767ef"}, @generic={0x7, 0x6, "47b57d8d"}, @cipso={0x86, 0x2e, 0xfffffffffffffffd, [{0x7, 0x9, "42a2eea2f47eb6"}, {0x0, 0x11, "2d6efa856a541dc7346664963301f8"}, {0x7, 0xe, "6019bb20d968b55002b9352b"}]}, @lsrr={0x83, 0x13, 0xe9, [@multicast1, @empty, @rand_addr=0x64010100, @local]}, @ssrr={0x89, 0x1f, 0xb9, [@loopback, @broadcast, @rand_addr=0x64010101, @remote, @multicast1, @private=0xa010101, @broadcast]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000080)={'gre0\x00', &(0x7f0000000280)={'syztnl1\x00', r4, 0x20, 0x80, 0x1000, 0x756, {{0x5, 0x4, 0x2, 0x37, 0x14, 0x66, 0xe0, 0xe8, 0x2f, 0x0, @loopback, @empty}}}}) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 2.313800152s ago: executing program 5 (id=4778): r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x101a40, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0x8000200d}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000f2cff4)={0x77540947ed9a168d}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000400), 0x4400, 0x0) preadv2(r2, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fe00}], 0x1, 0x0, 0x0, 0x2b) 1.37639305s ago: executing program 3 (id=4779): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{&(0x7f0000000040)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000000740)=[{&(0x7f00000000c0)=""/83, 0x53}, {&(0x7f0000000140)=""/175, 0xaf}, {&(0x7f0000000240)=""/85, 0x55}, {&(0x7f0000000300)=""/253, 0xfd}, {&(0x7f0000000440)=""/226, 0xe2}, {&(0x7f0000000540)=""/205, 0xcd}, {&(0x7f0000000640)=""/158, 0x9e}, {&(0x7f0000000700)=""/54, 0x36}], 0x8, &(0x7f00000007c0)=""/9, 0x9}, 0xfff}, {{0x0, 0x0, &(0x7f0000001880)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/88, 0x58}], 0x2, &(0x7f00000018c0)=""/208, 0xd0}, 0x40}, {{&(0x7f00000019c0)=@hci, 0x80, &(0x7f0000002f00)=[{&(0x7f0000001a40)=""/4096, 0x1000}, {&(0x7f0000002a40)=""/139, 0x8b}, {&(0x7f0000002b00)}, {&(0x7f0000002b40)=""/170, 0xaa}, {&(0x7f0000002c00)=""/133, 0x85}, {&(0x7f0000002cc0)=""/138, 0x8a}, {&(0x7f0000002d80)=""/66, 0x42}, {&(0x7f0000002e00)=""/252, 0xfc}], 0x8}, 0x7}], 0x3, 0x12141, 0x0) 1.301283256s ago: executing program 1 (id=4780): ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) bpf$BPF_MAP_FREEZE(0x16, &(0x7f00000000c0)=r0, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x1370, &(0x7f00000000c0)={0x0, 0x49fa, 0x10, 0x0, 0x4e}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0xfffffe32, 0x1, {0xc7, '\x00', 0x86dc, 0x3, 0x100, 0xc}}}}]}, 0x48}}, 0x4000010) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[0xffffffffffffffff], 0x1}) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f0000000800)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r8, &(0x7f0000000300)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @remote}, 0x14) socket$packet(0x11, 0x2, 0x300) r10 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r11 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r11, 0x707, &(0x7f0000002580)={&(0x7f00000002c0)=[{0x50, 0x1801, 0x0, 0x0}, {0x7, 0x4200, 0x0, 0x0}, {0x794, 0xd201, 0x0, 0x0}], 0x3}) sendmsg$NL80211_CMD_NEW_KEY(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000b000000080003005eeda3a0530999fe7c7737e1910b2320db115954280a4c5f4f2c252798d16ffc55354bcb1b06623c7be48f83f11536d527f24f420dccb71887bf81582d93a1ea9ed62b362c91a210040ba82b472f0cbe152b1c12f50baee57d0b9e84c7d5279c21181600cdb849e067cb0574396a0ce410bbd43c9bd0ee376fb48cfaed974193d1b60fcb1cceef98e8f4", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r12) 1.276409558s ago: executing program 5 (id=4781): r0 = socket(0x40000000015, 0x5, 0x0) socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x200000000114, 0x271e, 0x0, &(0x7f0000000040)) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)='4', 0x1}], 0x1) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000180)=0xfff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000001c0)=0x24, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r3, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000000)={0xffd3, 0x8, 0x800c, 0x0, 0x501, 0x5, 0xff, 0x2, 0x0}, &(0x7f0000000040)=0x20) syz_emit_ethernet(0x46, &(0x7f0000000100)=ANY=[@ANYBLOB="0380c20000000e577ca5a84f0800451000380080000000019078ac1e0001ac1414aa030490781206183f25000000006700000033000064010101e00000020018630100000003c7057e7e98299040477cb8f0c7ecb4294a5d84fabde2c78941e180f6218f0bef3e43ca90b0726fd10f7708bbf7b4204c0606678ccb"], 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f00000000c0)={r4, 0x3ff, 0x978}, 0x8) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000000)={0x3, 0x8}) 1.15835811s ago: executing program 3 (id=4782): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000005c0)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000013a40)={0x0, 0x0, &(0x7f0000013a00)={&(0x7f00000158c0), 0x10b8c}}, 0x0) 961.489489ms ago: executing program 5 (id=4783): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000e, 0x4008032, 0xffffffffffffffff, 0xcdc2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) munlock(&(0x7f0000a0e000/0x4000)=nil, 0x4000) r0 = socket$inet(0x2, 0x2000000080002, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x108) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r2 = socket$inet6(0xa, 0x805, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x200, 0x3, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0x0, 0x6a9f0eede9332711}, {0x2, 0xffff}, {0xe, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x44041}, 0x10) getsockopt$bt_hci(r2, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000004c40)={'syztnl0\x00', &(0x7f0000004b80)={'syztnl2\x00', 0x0, 0x7800, 0x8, 0x0, 0x25, {{0x27, 0x4, 0x0, 0x9, 0x9c, 0x65, 0x0, 0x7, 0x29, 0x0, @loopback, @broadcast, {[@timestamp_addr={0x44, 0x34, 0xe2, 0x1, 0xc, [{@dev={0xac, 0x14, 0x14, 0x17}, 0xbf}, {@local, 0xa2c}, {@local, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000001}, {@private=0xa010101, 0x6}, {@local, 0x10000}]}, @generic={0x83, 0xf, "eea411ad2a0e7f45cfd9cfeb19"}, @rr={0x7, 0x1b, 0x8, [@multicast2, @rand_addr=0x64010101, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x28}, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast]}, @timestamp={0x44, 0x28, 0x55, 0x0, 0x9, [0x7, 0x5, 0x1, 0x4, 0x3ff, 0x0, 0x5, 0x3, 0x6]}]}}}}}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) r4 = semget$private(0x0, 0x1, 0x40) semctl$SETVAL(r4, 0x0, 0x10, 0x0) semctl$IPC_RMID(r4, 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) clock_gettime(0x0, &(0x7f00000062c0)={0x0, 0x0}) r8 = msgget$private(0x0, 0x101) msgctl$MSG_STAT(r8, 0xb, &(0x7f0000001100)=""/79) futex(&(0x7f0000006280)=0x2, 0xb, 0x2, &(0x7f0000006300)={r6, r7+10000000}, &(0x7f0000006340)=0x2, 0x2) 221.378434ms ago: executing program 3 (id=4784): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xe7ac4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(r1, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (fail_nth: 11) 0s ago: executing program 4 (id=4785): socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x1000, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xd7) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x10000008, 0x0, 0x0, 0x0, 0x960, 0xfffffffffffffffe}, 0x0) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r3, 0x8946, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000140)=0x2000) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r4, 0x0) r5 = mq_open(&(0x7f0000000180)=' \x01\x9c\x147\xb3\xcf\xfc\xc3\xa2W)\xebs\x93\xa7\xc7!Q\x8f\xf6\xec\xa5fs\xf5l{T\x87r\xd2)r\xa7\xd6\bO\x9a\x98\xf52:\"\xf4\x12\xc0T+\xcd\x9fv|\x8d\xd5\xb2Dvc\x8e\x93\xd8\xd6\xa0\xc56\xd2x\xe3c:\x00\x00\x00\x00\x00\x00\x00\x00\x97\x97\x9c \xdc\xaavt\x18\xcen\xe4\x03\x84;7\xfb\x84r\xf4\xe7\xc9\b\x987\xaa\x85\xfb\x05%\xa8\xe5b\x81\x8e}\xe1r\xf7s2\x82\xe57&b', 0x41, 0x80, 0x0) mmap(&(0x7f000074f000/0x1000)=nil, 0x1000, 0xb635773f04ebbeee, 0x11, r5, 0x15b77000) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000200)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socket$nl_route(0x10, 0x3, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f00000001c0)=0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r7, 0xc0045516, &(0x7f0000000000)=0xffb) r8 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r8, 0xc1105517, &(0x7f0000000340)={{0x1000, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x10001, 'syz1\x00', 0x0}) close_range(r6, 0xffffffffffffffff, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 1122/0x1310 [ 1426.321469][T24290] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1426.321500][T24290] arch_do_signal_or_restart+0x3e5/0x780 [ 1426.321523][T24290] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1426.321554][T24290] ? local_irq_enable_exit_to_user+0x5/0x10 [ 1426.321580][T24290] syscall_exit_to_user_mode+0x8b/0x120 [ 1426.321600][T24290] do_syscall_64+0x103/0x210 [ 1426.321621][T24290] ? clear_bhb_loop+0x60/0xb0 [ 1426.321639][T24290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1426.321654][T24290] RIP: 0033:0x7fe935b8e967 [ 1426.321668][T24290] Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 [ 1426.321680][T24290] RSP: 002b:00007fe936a5e038 EFLAGS: 00000246 ORIG_RAX: 000000000000003d [ 1426.321696][T24290] RAX: 000000000000003d RBX: 00007fe935db5fa0 RCX: 00007fe935b8e969 [ 1426.321707][T24290] RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1426.321716][T24290] RBP: 00007fe936a5e090 R08: 0000000000000000 R09: 0000000000000000 [ 1426.321725][T24290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1426.321733][T24290] R13: 0000000000000000 R14: 00007fe935db5fa0 R15: 00007fe935edfa28 [ 1426.321756][T24290] [ 1426.564222][T11716] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1426.625869][T11742] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1426.694290][ T5894] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1426.735054][T11716] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 1426.743358][T11716] usb 5-1: config 0 has no interface number 0 [ 1426.752461][T11716] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=4f.5d [ 1426.761707][T11716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1426.769862][T11716] usb 5-1: Product: syz [ 1426.774146][T11716] usb 5-1: Manufacturer: syz [ 1426.779045][T11716] usb 5-1: SerialNumber: syz [ 1426.787022][T11716] usb 5-1: config 0 descriptor?? [ 1426.796513][T11716] usbtest 5-1:0.85: Linux gadget zero [ 1426.802049][T11716] usbtest 5-1:0.85: high-speed {control in/out int-out} tests (+alt) [ 1426.804902][T11742] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 1426.856661][ T5894] usb 2-1: Using ep0 maxpacket: 8 [ 1426.876287][T11742] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.887555][T11742] usb 4-1: config 0 has no interface number 0 [ 1426.897783][T11742] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1426.913189][ T5894] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1426.925153][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1426.934971][T11742] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1426.948559][ T5894] usb 2-1: Product: syz [ 1426.952872][ T5894] usb 2-1: Manufacturer: syz [ 1426.957703][ T5894] usb 2-1: SerialNumber: syz [ 1426.969981][T11742] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1426.983957][ T5894] usb 2-1: config 0 descriptor?? [ 1426.991937][T11742] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.008411][ T5894] gspca_main: se401-2.14.0 probing 047d:5003 [ 1427.016432][T11742] usb 4-1: Product: syz [ 1427.020653][T11742] usb 4-1: Manufacturer: syz [ 1427.037494][T11742] usb 4-1: SerialNumber: syz [ 1427.060695][T11742] usb 4-1: config 0 descriptor?? [ 1427.277172][T11742] usbtouchscreen 4-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 1427.285520][T11714] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1427.321395][T11742] usb 4-1: USB disconnect, device number 104 [ 1427.407264][ T5894] gspca_se401: Wrong descriptor type [ 1427.432782][T11714] usb 3-1: Using ep0 maxpacket: 16 [ 1427.455455][T11714] usb 3-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 1427.478375][T11714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=8 [ 1427.506444][T11714] usb 3-1: SerialNumber: syz [ 1427.516902][T11714] usb 3-1: config 0 descriptor?? [ 1427.547623][T11714] usb_8dev 3-1:0.0 can0: sending command message failed [ 1427.559364][T11714] usb_8dev 3-1:0.0 can0: can't get firmware version [ 1427.592558][T11742] usb 5-1: USB disconnect, device number 80 [ 1427.640944][T11714] usb_8dev 3-1:0.0: probe with driver usb_8dev failed with error -22 [ 1427.687392][T24011] usb 2-1: USB disconnect, device number 71 [ 1427.754093][T11714] usb 3-1: USB disconnect, device number 81 [ 1428.405461][T24327] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4456'. [ 1428.752966][ T5894] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1428.815603][T24335] FAULT_INJECTION: forcing a failure. [ 1428.815603][T24335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1428.833276][T11714] usb 3-1: new low-speed USB device number 82 using dummy_hcd [ 1428.859851][T24335] CPU: 1 UID: 0 PID: 24335 Comm: syz.5.4460 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1428.859883][T24335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1428.859897][T24335] Call Trace: [ 1428.859905][T24335] [ 1428.859916][T24335] dump_stack_lvl+0x189/0x250 [ 1428.859946][T24335] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1428.859967][T24335] ? __pfx__printk+0x10/0x10 [ 1428.859985][T24335] ? get_sigframe+0x596/0x7d0 [ 1428.860005][T24335] should_fail_ex+0x414/0x560 [ 1428.860026][T24335] _copy_to_user+0x31/0xb0 [ 1428.860051][T24335] copy_siginfo_to_user+0x22/0xc0 [ 1428.860067][T24335] x64_setup_rt_frame+0x777/0xd40 [ 1428.860098][T24335] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1428.860120][T24335] arch_do_signal_or_restart+0x3e5/0x780 [ 1428.860138][T24335] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1428.860163][T24335] ? local_irq_enable_exit_to_user+0x5/0x10 [ 1428.860189][T24335] syscall_exit_to_user_mode+0x8b/0x120 [ 1428.860210][T24335] do_syscall_64+0x103/0x210 [ 1428.860231][T24335] ? clear_bhb_loop+0x60/0xb0 [ 1428.860250][T24335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.860264][T24335] RIP: 0033:0x7f45e538e967 [ 1428.860277][T24335] Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 [ 1428.860289][T24335] RSP: 002b:00007f45e6242038 EFLAGS: 00000246 ORIG_RAX: 000000000000003d [ 1428.860305][T24335] RAX: 000000000000003d RBX: 00007f45e55b5fa0 RCX: 00007f45e538e969 [ 1428.860315][T24335] RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1428.860325][T24335] RBP: 00007f45e6242090 R08: 0000000000000000 R09: 0000000000000000 [ 1428.860334][T24335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1428.860343][T24335] R13: 0000000000000000 R14: 00007f45e55b5fa0 R15: 00007f45e56dfa28 [ 1428.860365][T24335] [ 1429.287283][ T5894] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1429.310274][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.331103][T11714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1429.331862][ T5894] usb 2-1: config 0 descriptor?? [ 1429.341915][T11714] usb 3-1: New USB device found, idVendor=1345, idProduct=3008, bcdDevice= 0.00 [ 1429.358113][ T5894] cp210x 2-1:0.0: cp210x converter detected [ 1429.374420][T11714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.408060][T11714] usb 3-1: config 0 descriptor?? [ 1429.422209][T24344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1429.447393][T24344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1429.629252][ T5894] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1429.897227][T24331] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1429.951636][T11714] sony 0003:1345:3008.0037: item fetching failed at offset 4/5 [ 1429.972351][T11714] sony 0003:1345:3008.0037: parse failed [ 1429.989471][T11714] sony 0003:1345:3008.0037: probe with driver sony failed with error -22 [ 1430.160490][T11714] usb 3-1: USB disconnect, device number 82 [ 1430.192619][ T5894] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1430.355790][ T5894] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1430.370823][T11716] usb 2-1: USB disconnect, device number 72 [ 1430.379941][T11716] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1430.408285][ T5894] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1430.415656][T11716] cp210x 2-1:0.0: device disconnected [ 1430.469563][ T5894] usb 4-1: config 220 has no interface number 2 [ 1430.482308][ T5894] usb 4-1: config 220 interface 1 altsetting 5 has an endpoint descriptor with address 0x58, changing to 0x8 [ 1430.547522][ T5894] usb 4-1: config 220 interface 1 altsetting 5 endpoint 0x8 has invalid wMaxPacketSize 0 [ 1430.607748][ T5894] usb 4-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 1430.654436][ T5894] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1430.673656][T11714] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1430.691745][ T5894] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1430.711647][ T5894] usb 4-1: config 220 interface 1 has no altsetting 0 [ 1430.757886][ T5894] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1430.777447][ T5894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1430.808843][ T5894] usb 4-1: Product: syz [ 1430.817913][ T5894] usb 4-1: Manufacturer: syz [ 1430.830576][ T5894] usb 4-1: SerialNumber: syz [ 1430.832699][T11714] usb 5-1: Using ep0 maxpacket: 16 [ 1430.848499][T11714] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1430.867518][T11714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1430.922882][T11716] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1430.952320][T11714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1430.985837][T11714] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1431.004013][T11714] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1431.018983][T11714] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1431.058569][T11714] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1431.097587][ T5894] usb 4-1: selecting invalid altsetting 0 [ 1431.106768][T11714] usb 5-1: Manufacturer: syz [ 1431.132934][T11716] usb 2-1: Using ep0 maxpacket: 16 [ 1431.140601][T11716] usb 2-1: too many endpoints for config 0 interface 0 altsetting 109: 65, using maximum allowed: 30 [ 1431.156609][ T5894] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 1431.156785][T11714] usb 5-1: config 0 descriptor?? [ 1431.181537][ T5894] usb 4-1: No valid video chain found. [ 1431.212779][ T5894] usb 4-1: selecting invalid altsetting 0 [ 1431.221812][T11716] usb 2-1: config 0 interface 0 altsetting 109 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1431.250076][T11716] usb 2-1: config 0 interface 0 altsetting 109 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 1431.280236][ T5894] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 1431.310884][T11716] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1431.332993][T11716] usb 2-1: New USB device found, idVendor=172f, idProduct=0500, bcdDevice= 0.00 [ 1431.357117][T11716] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1431.379299][ T5894] usb 4-1: USB disconnect, device number 105 [ 1431.468884][T11716] usb 2-1: config 0 descriptor?? [ 1431.632904][T11714] rc_core: IR keymap rc-hauppauge not found [ 1431.664647][T11714] Registered IR keymap rc-empty [ 1431.722884][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1431.793485][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1431.822388][T24363] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4467'. [ 1431.913081][T11714] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 1431.943642][T11716] waltop 0003:172F:0500.0038: unknown main item tag 0x0 [ 1432.005311][T11716] waltop 0003:172F:0500.0038: unknown main item tag 0x0 [ 1432.015872][T11714] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input137 [ 1432.040973][T11716] waltop 0003:172F:0500.0038: unknown main item tag 0x0 [ 1432.062259][T24364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1432.099441][T24364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1432.118826][T11716] waltop 0003:172F:0500.0038: unknown main item tag 0x0 [ 1432.171354][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.220337][T11716] waltop 0003:172F:0500.0038: unknown main item tag 0x0 [ 1432.227238][T24366] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4468'. [ 1432.241780][T24366] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4468'. [ 1432.272814][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.280442][T24366] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1432.302302][T11716] waltop 0003:172F:0500.0038: hidraw0: USB HID v0.05 Device [HID 172f:0500] on usb-dummy_hcd.1-1/input0 [ 1432.332964][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.349186][T24366] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 1432.382868][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.391095][T11716] usb 2-1: USB disconnect, device number 73 [ 1432.413150][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.495633][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.534460][T24373] netlink: 'syz.2.4469': attribute type 11 has an invalid length. [ 1432.562887][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.602738][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.650731][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.675340][T24371] fido_id[24371]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1432.712753][T11714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 1432.794905][T11714] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1432.847232][T24377] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1432.853828][T24377] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1432.862249][T11714] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1432.922055][T11714] usb 5-1: USB disconnect, device number 81 [ 1432.937230][T24377] vhci_hcd vhci_hcd.0: Device attached [ 1433.018042][T24378] vhci_hcd: connection closed [ 1433.018351][ T12] vhci_hcd: stop threads [ 1433.085032][ T12] vhci_hcd: release socket [ 1433.113973][ T12] vhci_hcd: disconnect device [ 1433.492720][T24397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1433.561335][T24397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1433.612675][T24397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1433.652785][T24397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1433.825486][ T5894] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1433.962826][T11714] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1433.993135][ T5894] usb 5-1: Using ep0 maxpacket: 8 [ 1434.010853][ T5894] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1434.025314][ T5894] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1434.036753][ T5894] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1434.048626][ T5894] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1434.063251][ T5894] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1434.083265][ T5894] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1434.116217][ T5894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1434.172679][T11714] usb 4-1: Using ep0 maxpacket: 16 [ 1434.206253][T11714] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1434.223003][T11714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1434.251556][T11714] usb 4-1: Product: syz [ 1434.261693][T11714] usb 4-1: Manufacturer: syz [ 1434.281994][T11714] usb 4-1: SerialNumber: syz [ 1434.294908][T11714] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1434.312776][T11714] r8152-cfgselector 4-1: config 0 descriptor?? [ 1434.372962][ T5894] usb 5-1: usb_control_msg returned -32 [ 1434.402880][ T5894] usbtmc 5-1:16.0: can't read capabilities [ 1434.637032][T24407] usb usb8: usbfs: process 24407 (syz.5.4479) did not claim interface 0 before use [ 1434.658752][T24409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1434.675379][T24409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1435.055336][T24417] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 1435.249607][T24422] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4481'. [ 1435.279037][T11716] r8152-cfgselector 4-1: USB disconnect, device number 106 [ 1435.754026][T24439] fuse: Unknown parameter 'xÂçät0x0000000000000003' [ 1435.867807][T24443] fuse: Bad value for 'group_id' [ 1435.922372][T24443] fuse: Bad value for 'group_id' [ 1436.112907][T11716] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1436.142630][T11736] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1436.276391][T11716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1436.290044][T11716] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1436.309220][T11716] usb 3-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 1436.312814][T11736] usb 2-1: Using ep0 maxpacket: 32 [ 1436.329324][T11716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1436.341547][T11736] usb 2-1: config 0 has an invalid interface number: 136 but max is 0 [ 1436.350230][T11716] usb 3-1: config 0 descriptor?? [ 1436.355521][T11736] usb 2-1: config 0 has no interface number 0 [ 1436.361899][T11736] usb 2-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 1436.377964][T11736] usb 2-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1436.389588][T11736] usb 2-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1436.411744][T11736] usb 2-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1436.442785][T11736] usb 2-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1436.462620][T11736] usb 2-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 1436.472146][T11736] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1436.489648][T11736] usb 2-1: config 0 descriptor?? [ 1436.511214][T11736] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1436.990938][T11736] usb 5-1: USB disconnect, device number 82 [ 1438.095255][T11716] usbhid 3-1:0.0: can't add hid device: -71 [ 1438.107094][T11716] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1438.115498][T11714] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1438.129180][T11716] usb 3-1: USB disconnect, device number 83 [ 1438.282817][T11714] usb 5-1: Using ep0 maxpacket: 32 [ 1438.320930][T11714] usb 5-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1438.345753][T24473] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4497'. [ 1438.385951][T11714] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1438.413882][T11714] usb 5-1: New USB device found, idVendor=5543, idProduct=0781, bcdDevice= 0.00 [ 1438.490874][T11714] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1438.528243][T11714] usb 5-1: config 0 descriptor?? [ 1438.727711][T11716] usb 2-1: USB disconnect, device number 74 [ 1438.771827][T11714] usbhid 5-1:0.0: can't add hid device: -71 [ 1438.798596][T11714] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1438.903603][T11714] usb 5-1: USB disconnect, device number 83 [ 1438.924145][T11742] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 1438.940660][T24480] netlink: 228 bytes leftover after parsing attributes in process `syz.3.4499'. [ 1439.143681][T11742] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1439.178266][T11742] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1439.217241][T11742] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1439.263456][T11742] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1439.319545][T11742] usb 3-1: config 0 descriptor?? [ 1439.350444][T11742] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1439.395936][T11742] dvb-usb: bulk message failed: -22 (3/0) [ 1439.436268][T11742] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1439.507977][T11742] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1439.550002][T24477] dvb-usb: bulk message failed: -22 (2/0) [ 1439.558408][T11742] usb 3-1: media controller created [ 1439.599781][T11742] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1439.667407][T11742] dvb-usb: bulk message failed: -22 (6/0) [ 1439.697472][T11742] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1439.730226][T11742] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input138 [ 1439.820258][T11742] dvb-usb: schedule remote query interval to 150 msecs. [ 1439.858049][T11742] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1439.901533][T24489] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1439.915693][T11742] usb 3-1: USB disconnect, device number 84 [ 1439.984924][T24485] input: syz0 as /devices/virtual/input/input139 [ 1440.104249][T11742] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1440.469778][T24495] syz.5.4502 (24495): drop_caches: 2 [ 1440.583404][T24504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1440.629150][T24504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1440.874231][T24518] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4506'. [ 1440.926987][T24518] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4506'. [ 1440.955436][T24520] openvswitch: netlink: IP tunnel dst address not specified [ 1440.965250][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.221556][T24518] hsr_slave_1 (unregistering): left promiscuous mode [ 1441.320958][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.582807][T11742] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1441.597949][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.663806][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.695845][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.725447][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.812669][T11742] usb 5-1: Using ep0 maxpacket: 32 [ 1441.820055][T11742] usb 5-1: config 0 has an invalid interface number: 136 but max is 0 [ 1441.820353][T24521] netlink: 'syz.1.4509': attribute type 8 has an invalid length. [ 1441.843031][T11742] usb 5-1: config 0 has no interface number 0 [ 1441.863660][T11742] usb 5-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 1441.910032][T11742] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1441.986422][T11742] usb 5-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1442.045077][T11742] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1442.125902][T11742] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1442.193849][T11742] usb 5-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 1442.220038][T11742] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1442.280699][T11742] usb 5-1: config 0 descriptor?? [ 1442.321075][T11742] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1442.642267][T24538] fuse: Unknown parameter 'roo÷Ìh¯e' [ 1442.792846][T11714] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1442.962602][T11714] usb 4-1: Using ep0 maxpacket: 32 [ 1443.026194][T11714] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1443.056641][T11714] usb 4-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=93.a8 [ 1443.083478][T11714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.105304][T11714] usb 4-1: Product: syz [ 1443.114909][T11714] usb 4-1: Manufacturer: syz [ 1443.120254][T11714] usb 4-1: SerialNumber: syz [ 1443.129755][T11714] usb 4-1: config 0 descriptor?? [ 1443.427719][T11714] ath6kl: Failed to submit usb control message: -71 [ 1443.442489][T11714] ath6kl: unable to send the bmi data to the device: -71 [ 1443.487801][T24545] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4514'. [ 1443.510906][T24539] netlink: 'syz.2.4512': attribute type 10 has an invalid length. [ 1443.524692][T24539] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4512'. [ 1443.557162][T24539] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1443.597861][T11714] ath6kl: Unable to send get target info: -71 [ 1443.683304][T11714] ath6kl: Failed to init ath6kl core: -71 [ 1443.690490][T11714] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1443.799148][T11714] usb 4-1: USB disconnect, device number 107 [ 1444.472985][T14841] usb 2-1: new low-speed USB device number 75 using dummy_hcd [ 1444.625771][T14841] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 1444.635018][T14841] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 1444.643486][T14841] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1444.653412][T14841] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 1444.665104][T14841] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x5D, changing to 0xD [ 1444.677429][T14841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 10 [ 1444.689089][T14841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 1444.703166][T14841] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 1444.720610][T14841] usb 2-1: string descriptor 0 read error: -22 [ 1444.729923][T14841] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1444.740176][T14841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.762342][T14841] usb 2-1: config 0 descriptor?? [ 1444.772236][T14841] hub 2-1:0.0: bad descriptor, ignoring hub [ 1444.785935][T14841] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1445.122722][T14841] usb 2-1: USB disconnect, device number 75 [ 1445.133077][T11716] usb 5-1: USB disconnect, device number 84 [ 1445.350957][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 1445.350977][ T30] audit: type=1326 audit(1748257725.363:6067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24561 comm="syz.2.4518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe935b8e969 code=0x7ffc0000 [ 1445.399128][ T30] audit: type=1326 audit(1748257725.413:6068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24561 comm="syz.2.4518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=116 compat=0 ip=0x7fe935b8e969 code=0x7ffc0000 [ 1445.435900][ T30] audit: type=1326 audit(1748257725.453:6069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24561 comm="syz.2.4518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe935b8e969 code=0x7ffc0000 [ 1446.382766][T24011] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1446.577187][T24011] usb 4-1: Using ep0 maxpacket: 16 [ 1446.611234][T24011] usb 4-1: config 0 has an invalid interface number: 180 but max is 0 [ 1446.640583][T24011] usb 4-1: config 0 has no interface number 0 [ 1446.684857][T24011] usb 4-1: New USB device found, idVendor=0421, idProduct=0134, bcdDevice=11.72 [ 1446.716000][T24011] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1446.759377][T24011] usb 4-1: Product: syz [ 1446.784784][T24011] usb 4-1: Manufacturer: syz [ 1446.800345][T24011] usb 4-1: SerialNumber: syz [ 1446.894178][T24011] usb 4-1: config 0 descriptor?? [ 1446.907933][T24011] usb 4-1: bad CDC descriptors [ 1447.116878][T24011] usb 4-1: USB disconnect, device number 108 [ 1447.722172][T24580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1447.740632][T24580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1448.496916][T24591] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4524'. [ 1448.508086][T24591] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4524'. [ 1448.520113][T24591] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 1448.557525][T24591] bond2: entered allmulticast mode [ 1448.563471][T24591] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1448.723561][T24592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1448.764202][T24592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1449.003286][T11736] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1449.032783][T14841] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 1449.062644][T11742] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1449.175679][T11736] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1449.187507][T11736] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1449.197240][T11736] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1449.210775][T11736] usb 3-1: config 0 descriptor?? [ 1449.266520][T11742] usb 2-1: Using ep0 maxpacket: 8 [ 1449.279436][T11742] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1449.293118][T11716] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1449.320459][T11742] usb 2-1: config 8 has an invalid interface number: 24 but max is 1 [ 1449.359283][T11742] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.398978][T11742] usb 2-1: config 8 has 1 interface, different from the descriptor's value: 2 [ 1449.412341][T14841] usb 4-1: not running at top speed; connect to a high speed hub [ 1449.452832][T11716] usb 5-1: Using ep0 maxpacket: 32 [ 1449.480873][T11716] usb 5-1: config 0 has an invalid interface number: 136 but max is 0 [ 1449.518762][T11716] usb 5-1: config 0 has no interface number 0 [ 1449.561030][T11716] usb 5-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 1449.604121][T11716] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1449.630535][T11716] usb 5-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1449.659829][T11716] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1449.686227][T11716] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1449.717581][T11742] usb 2-1: config 8 has no interface number 0 [ 1449.724799][T11742] usb 2-1: config 8 interface 24 altsetting 2 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 1449.745450][T11716] usb 5-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 1449.754532][T11742] usb 2-1: config 8 interface 24 altsetting 2 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1449.790075][T11716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1449.803524][T11742] usb 2-1: config 8 interface 24 altsetting 2 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1449.841283][T11716] usb 5-1: config 0 descriptor?? [ 1449.854401][T11742] usb 2-1: config 8 interface 24 has no altsetting 0 [ 1449.871999][T11716] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1450.006593][T11742] usb 2-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 1450.077351][T23909] udevd[23909]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.136/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1450.194405][T11742] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1450.480240][T11742] usb 2-1: Product: syz [ 1450.532795][T11742] usb 2-1: Manufacturer: syz [ 1450.658575][T11742] usb 2-1: SerialNumber: syz [ 1451.311486][T14841] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1451.373195][T14841] usb 4-1: can't read configurations, error -71 [ 1451.683268][T11736] usbhid 3-1:0.0: can't add hid device: -71 [ 1451.689698][T11736] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1451.700772][T11736] usb 3-1: USB disconnect, device number 85 [ 1451.749565][T24600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1451.787447][ T5894] usb 5-1: USB disconnect, device number 85 [ 1451.842246][T24600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1451.853782][T24619] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4534'. [ 1452.062671][T14841] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1452.234087][T14841] usb 4-1: device descriptor read/64, error -71 [ 1452.373076][T14841] usb usb4-port1: attempt power cycle [ 1452.502739][T11716] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1452.668926][T24629] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4537'. [ 1452.704818][T11716] usb 5-1: config 68 has an invalid interface number: 220 but max is 0 [ 1452.722348][T11716] usb 5-1: config 68 has no interface number 0 [ 1452.745679][T11716] usb 5-1: config 68 interface 220 has no altsetting 0 [ 1452.767388][T14841] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 1452.772395][T11716] usb 5-1: New USB device found, idVendor=0497, idProduct=c001, bcdDevice=55.7a [ 1452.795028][T11716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1452.812454][T11716] usb 5-1: Product: syz [ 1452.827658][T11716] usb 5-1: Manufacturer: syz [ 1452.828760][T14841] usb 4-1: device descriptor read/8, error -71 [ 1452.838846][T11716] usb 5-1: SerialNumber: syz [ 1453.074993][T11716] gspca_main: spca501-2.14.0 probing 0497:c001 [ 1453.097401][T11716] gspca_spca501: reg write: error -71 [ 1453.108226][T11716] spca501 5-1:68.220: Reg write failed for 0x02,0x07,0x05 [ 1453.132768][T11716] spca501 5-1:68.220: probe with driver spca501 failed with error -22 [ 1453.152824][T14841] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 1453.181303][T11716] usb 5-1: USB disconnect, device number 86 [ 1453.193456][T14841] usb 4-1: device descriptor read/8, error -71 [ 1453.261744][T11742] vmk80xx 2-1:8.24: driver 'vmk80xx' failed to auto-configure device. [ 1453.300118][T11742] vmk80xx 2-1:8.24: probe with driver vmk80xx failed with error -22 [ 1453.340088][T11742] usb 2-1: USB disconnect, device number 76 [ 1453.360383][T14841] usb usb4-port1: unable to enumerate USB device [ 1453.703032][T11742] usb 2-1: new full-speed USB device number 77 using dummy_hcd [ 1453.888068][T11742] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1453.910916][T24642] netlink: 'syz.5.4541': attribute type 8 has an invalid length. [ 1453.923070][T11742] usb 2-1: not running at top speed; connect to a high speed hub [ 1453.954606][T11742] usb 2-1: config 1 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1453.992404][T11742] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1454.002325][T11742] usb 2-1: New USB device found, idVendor=05ac, idProduct=0259, bcdDevice= 0.40 [ 1454.015316][T11742] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.042759][T14841] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1454.073309][T11742] usb 2-1: Product: syz [ 1454.077506][T11742] usb 2-1: Manufacturer: syz [ 1454.082097][T11742] usb 2-1: SerialNumber: syz [ 1454.121967][T24645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.133063][T24636] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1454.169442][T24645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1454.217880][T24645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.237586][T14841] usb 5-1: config 0 has no interfaces? [ 1454.263069][T24645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1454.278768][T14841] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1454.308679][T14841] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.328119][T14841] usb 5-1: Product: syz [ 1454.343611][T14841] usb 5-1: Manufacturer: syz [ 1454.357548][T14841] usb 5-1: SerialNumber: syz [ 1454.385831][T11742] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input140 [ 1454.467639][ T5185] bcm5974 2-1:1.0: could not read from device [ 1454.471186][T14841] usb 5-1: config 0 descriptor?? [ 1454.618154][ T5185] bcm5974 2-1:1.0: could not read from device [ 1454.673046][T11742] usb 2-1: USB disconnect, device number 77 [ 1455.057683][T24648] netlink: 'syz.3.4543': attribute type 4 has an invalid length. [ 1455.057968][T24640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.082865][T24640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.328195][T24657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.352499][T24657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.397038][T24658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.412735][T11714] usb 2-1: new full-speed USB device number 78 using dummy_hcd [ 1455.453869][T24658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.603305][T11714] usb 2-1: device descriptor read/64, error -71 [ 1455.800358][T24663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.826115][T24663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.885150][T11714] usb 2-1: new full-speed USB device number 79 using dummy_hcd [ 1456.022878][T24011] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1456.030701][T11714] usb 2-1: device descriptor read/64, error -71 [ 1456.153084][T11714] usb usb2-port1: attempt power cycle [ 1456.269201][T24667] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4548'. [ 1456.513183][T11714] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 1456.537673][T11714] usb 2-1: device descriptor read/8, error -71 [ 1456.632712][T24011] usb 3-1: device descriptor read/64, error -71 [ 1456.672847][ T5900] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 1456.782701][T11714] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 1456.803765][T11714] usb 2-1: device descriptor read/8, error -71 [ 1456.812689][ T5900] usb 4-1: device descriptor read/64, error -71 [ 1456.872676][T24011] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1456.915164][T11714] usb usb2-port1: unable to enumerate USB device [ 1457.025171][T24011] usb 3-1: config index 0 descriptor too short (expected 1051, got 27) [ 1457.033932][T24011] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 1457.042145][T24011] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1457.051502][T24011] usb 3-1: config 0 interface 0 altsetting 12 bulk endpoint 0x87 has invalid maxpacket 149 [ 1457.062038][T24011] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1457.071341][T24011] usb 3-1: New USB device found, idVendor=06cd, idProduct=010a, bcdDevice=d9.c3 [ 1457.072885][ T5900] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1457.082162][T24011] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.101379][T24011] usb 3-1: Product: syz [ 1457.106124][T24011] usb 3-1: Manufacturer: syz [ 1457.110856][T24011] usb 3-1: SerialNumber: syz [ 1457.124333][T24011] usb 3-1: config 0 descriptor?? [ 1457.130644][T24671] raw-gadget.6 gadget.2: fail, usb_ep_enable returned -22 [ 1457.233133][ T5900] usb 4-1: device descriptor read/64, error -71 [ 1457.294099][T11716] usb 5-1: USB disconnect, device number 87 [ 1457.348197][ T5900] usb usb4-port1: attempt power cycle [ 1457.724381][ T5900] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 1457.754768][ T5900] usb 4-1: device descriptor read/8, error -71 [ 1457.860575][T24679] netlink: 'syz.2.4549': attribute type 7 has an invalid length. [ 1457.911006][T24679] : entered promiscuous mode [ 1457.939173][ T30] audit: type=1326 audit(1748257737.953:6070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.001459][ T30] audit: type=1326 audit(1748257737.983:6071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=108 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.025384][T24679] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4549'. [ 1458.035199][ T5900] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 1458.043229][T24679] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 1458.060478][ T30] audit: type=1326 audit(1748257737.983:6072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.111991][ T30] audit: type=1326 audit(1748257737.983:6073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.140781][ T5900] usb 4-1: device descriptor read/8, error -71 [ 1458.274243][ T5900] usb usb4-port1: unable to enumerate USB device [ 1458.412675][T11716] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1458.475906][T24011] keyspan 3-1:0.0: Keyspan 4 port adapter converter detected [ 1458.484427][ T30] audit: type=1326 audit(1748257737.983:6074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.508861][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 7 [ 1458.527199][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 81 [ 1458.536180][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 1 [ 1458.543883][ T30] audit: type=1326 audit(1748257737.983:6075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.567944][ T30] audit: type=1326 audit(1748257737.983:6076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.591117][ T30] audit: type=1326 audit(1748257738.003:6077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.633015][T24011] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1458.643153][T11716] usb 5-1: Using ep0 maxpacket: 16 [ 1458.671585][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 82 [ 1458.688797][ T30] audit: type=1326 audit(1748257738.013:6078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.714178][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 2 [ 1458.716125][ T30] audit: type=1326 audit(1748257738.013:6079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.4.4552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f9c3cb8e969 code=0x7ffc0000 [ 1458.729848][T24011] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1458.732399][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 83 [ 1458.733349][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 3 [ 1458.736069][T24011] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1458.738045][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 84 [ 1458.738108][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 4 [ 1458.740780][T24011] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1458.744812][T24011] usb 3-1: USB disconnect, device number 87 [ 1458.748662][T24011] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1458.762832][T24011] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1458.772047][T24692] vlan1: entered promiscuous mode [ 1458.775330][T24011] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1458.911040][T24011] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1458.923566][T24011] keyspan 3-1:0.0: device disconnected [ 1459.052832][T11714] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1459.222936][T11714] usb 2-1: Using ep0 maxpacket: 16 [ 1459.230690][T11714] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1459.270997][T11714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1459.321845][T11714] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1459.335106][T11714] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.351730][T11714] usb 2-1: Product: syz [ 1459.364707][T11714] usb 2-1: Manufacturer: syz [ 1459.436487][T11714] usb 2-1: SerialNumber: syz [ 1459.457524][T24699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1459.469629][T11714] usb 2-1: config 0 descriptor?? [ 1459.485869][T11714] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1459.501845][T24699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1459.546331][T11714] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1459.752655][T24011] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1459.972584][T24011] usb 3-1: Using ep0 maxpacket: 16 [ 1460.020352][T24011] usb 3-1: config index 0 descriptor too short (expected 1828, got 36) [ 1460.029130][T24011] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 1460.079893][T24011] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.093125][T11714] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1460.100086][T11714] em28xx 2-1:0.0: Config register raw data: 0x41 [ 1460.155464][T24011] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1460.209531][T24011] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1460.222625][T24011] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1460.252166][T24011] usb 3-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=1a.1e [ 1460.265195][T24011] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1460.275416][T24011] usb 3-1: Product: syz [ 1460.279727][T24011] usb 3-1: Manufacturer: syz [ 1460.309109][T24689] input: syz1 as /devices/virtual/input/input141 [ 1460.320699][T24011] usb 3-1: SerialNumber: syz [ 1460.406067][T24011] usb 3-1: config 0 descriptor?? [ 1460.457007][T11714] usb 2-1: USB disconnect, device number 82 [ 1460.481309][T24011] keyspan 3-1:0.0: Keyspan 2 port adapter converter detected [ 1460.492438][T11714] em28xx 2-1:0.0: Disconnecting em28xx [ 1460.510341][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 87 [ 1460.564179][T11714] em28xx 2-1:0.0: Freeing device [ 1460.585237][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 7 [ 1460.640780][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 81 [ 1460.668671][T24710] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4559'. [ 1460.711051][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 1 [ 1460.735098][T24711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1460.751509][T24711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1460.769449][T24712] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4556'. [ 1460.780972][T24700] tipc: Enabled bearer , priority 22 [ 1460.860821][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 2 [ 1460.921262][T24710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1460.935781][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 85 [ 1460.944713][T24710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1461.030258][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 5 [ 1461.124857][T24011] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1461.251188][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 83 [ 1461.296915][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 3 [ 1461.319860][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 4 [ 1461.353022][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 86 [ 1461.381264][T24011] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 6 [ 1461.433439][T24011] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1461.482425][T24011] usb 3-1: USB disconnect, device number 88 [ 1461.584872][T24011] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1461.657325][T11716] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1461.714651][T11716] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1461.743762][T24011] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1461.753492][T11716] usb 5-1: can't read configurations, error -71 [ 1461.778752][T24011] keyspan 3-1:0.0: device disconnected [ 1461.824317][T24724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1461.850643][T24724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1461.892664][T11714] tipc: Node number set to 1840612574 [ 1462.019225][T11742] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1462.173028][T11716] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1462.202749][T11742] usb 4-1: Using ep0 maxpacket: 8 [ 1462.215221][T11742] usb 4-1: config 0 has an invalid interface number: 4 but max is 0 [ 1462.241063][T11742] usb 4-1: config 0 has no interface number 0 [ 1462.269317][T11742] usb 4-1: too many endpoints for config 0 interface 4 altsetting 73: 94, using maximum allowed: 30 [ 1462.281309][T11742] usb 4-1: config 0 interface 4 altsetting 73 has 0 endpoint descriptors, different from the interface descriptor's value: 94 [ 1462.296215][T11742] usb 4-1: config 0 interface 4 has no altsetting 0 [ 1462.307179][T11742] usb 4-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 1462.324837][T11742] usb 4-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 1462.342823][T11742] usb 4-1: Product: syz [ 1462.366643][T11742] usb 4-1: Manufacturer: syz [ 1462.379708][T11716] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1462.381879][T11742] usb 4-1: SerialNumber: syz [ 1462.408381][T11716] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1462.437531][T11742] usb 4-1: config 0 descriptor?? [ 1462.440478][T11716] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1462.472843][T11716] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1462.499211][T11716] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1462.532156][T11716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.556983][T11716] usb 5-1: config 0 descriptor?? [ 1462.702670][ T5900] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1462.889766][ T5900] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 1462.965547][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1462.985102][T11742] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 1463.022475][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 59391, setting to 1024 [ 1463.034017][T11742] gspca_zc3xx: reg_w_i err -71 [ 1463.042963][T11742] gspca_zc3xx 4-1:0.4: probe with driver gspca_zc3xx failed with error -71 [ 1463.061588][ T5900] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 1463.074836][T11742] usb 4-1: USB disconnect, device number 117 [ 1463.094682][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.126864][T24742] FAULT_INJECTION: forcing a failure. [ 1463.126864][T24742] name failslab, interval 1, probability 0, space 0, times 0 [ 1463.161102][ T5900] usb 2-1: config 0 descriptor?? [ 1463.176311][T24742] CPU: 1 UID: 0 PID: 24742 Comm: syz.2.4568 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1463.176347][T24742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1463.176362][T24742] Call Trace: [ 1463.176371][T24742] [ 1463.176381][T24742] dump_stack_lvl+0x189/0x250 [ 1463.176429][T24742] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1463.176460][T24742] ? __pfx__printk+0x10/0x10 [ 1463.176488][T24742] ? __pfx___might_resched+0x10/0x10 [ 1463.176507][T24742] ? fs_reclaim_acquire+0x7d/0x100 [ 1463.176543][T24742] should_fail_ex+0x414/0x560 [ 1463.176571][T24742] ? file_tty_write+0x2a6/0x990 [ 1463.176590][T24742] should_failslab+0xa8/0x100 [ 1463.176620][T24742] __kvmalloc_node_noprof+0x168/0x5e0 [ 1463.176650][T24742] ? file_tty_write+0x2a6/0x990 [ 1463.176676][T24742] file_tty_write+0x2a6/0x990 [ 1463.176709][T24742] vfs_write+0x548/0xa90 [ 1463.176739][T24742] ? __pfx_tty_write+0x10/0x10 [ 1463.176762][T24742] ? __pfx_vfs_write+0x10/0x10 [ 1463.176798][T24742] ? __fget_files+0x2a/0x420 [ 1463.176836][T24742] ksys_write+0x145/0x250 [ 1463.176859][T24742] ? rcu_is_watching+0x15/0xb0 [ 1463.176881][T24742] ? __pfx_ksys_write+0x10/0x10 [ 1463.176909][T24742] ? do_syscall_64+0xba/0x210 [ 1463.176943][T24742] do_syscall_64+0xf6/0x210 [ 1463.176971][T24742] ? clear_bhb_loop+0x60/0xb0 [ 1463.176997][T24742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1463.177018][T24742] RIP: 0033:0x7fe935b8e969 [ 1463.177036][T24742] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1463.177055][T24742] RSP: 002b:00007fe936a5e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1463.177077][T24742] RAX: ffffffffffffffda RBX: 00007fe935db5fa0 RCX: 00007fe935b8e969 [ 1463.177092][T24742] RDX: 0000000000001006 RSI: 0000200000000040 RDI: 0000000000000004 [ 1463.177106][T24742] RBP: 00007fe936a5e090 R08: 0000000000000000 R09: 0000000000000000 [ 1463.177119][T24742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1463.177131][T24742] R13: 0000000000000000 R14: 00007fe935db5fa0 R15: 00007fe935edfa28 [ 1463.177164][T24742] [ 1463.214255][T24734] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1463.221229][ T5900] gspca_main: spca561-2.14.0 probing abcd:cdee [ 1463.431254][ T5900] spca561 2-1:0.0: probe with driver spca561 failed with error -22 [ 1463.639046][ T5900] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1463.648489][ T5900] usb 2-1: MIDIStreaming interface descriptor not found [ 1463.667991][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1463.668012][ T30] audit: type=1326 audit(1748257743.683:6088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24744 comm="syz.2.4569" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe935b8e969 code=0x0 [ 1463.767443][ T5900] usb 2-1: USB disconnect, device number 83 [ 1463.769433][T24746] fuse: Bad value for 'fd' [ 1464.061348][T24752] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1464.114304][ T30] audit: type=1326 audit(1748257744.133:6089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.197406][ T30] audit: type=1326 audit(1748257744.133:6090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.279485][ T30] audit: type=1326 audit(1748257744.163:6091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.397297][ T30] audit: type=1326 audit(1748257744.163:6092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.471615][ T30] audit: type=1326 audit(1748257744.163:6093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.560372][ T30] audit: type=1326 audit(1748257744.163:6094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.696810][ T30] audit: type=1326 audit(1748257744.163:6095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.740387][T24770] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4577'. [ 1464.782817][ T30] audit: type=1326 audit(1748257744.163:6096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.807897][ T30] audit: type=1326 audit(1748257744.163:6097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24751 comm="syz.5.4571" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f45e538e969 code=0x7ffc0000 [ 1464.902815][T11714] usb 2-1: new full-speed USB device number 84 using dummy_hcd [ 1465.009420][T11716] usbhid 5-1:0.0: can't add hid device: -71 [ 1465.064721][T11716] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1465.093520][T11714] usb 2-1: config 0 has an invalid interface number: 20 but max is 0 [ 1465.124584][T11716] usb 5-1: USB disconnect, device number 89 [ 1465.130557][T11714] usb 2-1: config 0 has no interface number 0 [ 1465.192999][T11714] usb 2-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1465.243936][T11714] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1465.284386][T11714] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1465.304084][T11714] usb 2-1: Product: syz [ 1465.308304][T11714] usb 2-1: Manufacturer: syz [ 1465.367749][T11714] usb 2-1: SerialNumber: syz [ 1465.429486][T11714] usb 2-1: config 0 descriptor?? [ 1465.464344][T24768] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1465.506252][T11714] ums-sddr09 2-1:0.20: USB Mass Storage device detected [ 1465.632793][ T5900] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 1465.755328][T11714] ums-sddr09 2-1:0.20: probe with driver ums-sddr09 failed with error -22 [ 1465.830071][T11714] usb 2-1: USB disconnect, device number 84 [ 1465.894758][ T5900] usb 4-1: Using ep0 maxpacket: 32 [ 1465.905518][ T5900] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 1465.940350][ T5900] usb 4-1: config 0 has no interface number 0 [ 1465.997347][ T5900] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1466.106850][ T5900] usb 4-1: config 0 interface 85 has no altsetting 0 [ 1466.164127][ T5900] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1466.207009][ T5900] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.249813][ T5900] usb 4-1: Product: syz [ 1466.292657][ T5900] usb 4-1: Manufacturer: syz [ 1466.297365][ T5900] usb 4-1: SerialNumber: syz [ 1466.343207][ T5900] usb 4-1: config 0 descriptor?? [ 1466.352726][T24773] delete_channel: no stack [ 1466.679533][T24781] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4581'. [ 1466.735090][T24781] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4581'. [ 1467.052848][T11742] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1467.213024][ T5900] appletouch 4-1:0.85: Geyser mode initialized. [ 1467.282279][ T5900] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input142 [ 1467.456984][T14841] usb 4-1: USB disconnect, device number 118 [ 1467.456993][ C1] appletouch 4-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 1467.638530][T14841] appletouch 4-1:0.85: input: appletouch disconnected [ 1467.719892][T24804] netlink: 'syz.1.4584': attribute type 39 has an invalid length. [ 1467.824031][T24804] bridge0: port 1(syz_tun) entered disabled state [ 1467.906614][T24804] syz_tun (unregistering): left allmulticast mode [ 1467.924752][T24804] syz_tun (unregistering): left promiscuous mode [ 1467.962654][T24804] bridge0: port 1(syz_tun) entered disabled state [ 1468.063954][T24809] vti0: entered promiscuous mode [ 1468.737845][T14841] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1468.912707][T14841] usb 4-1: Using ep0 maxpacket: 32 [ 1468.920256][T14841] usb 4-1: config 0 has an invalid interface number: 219 but max is 0 [ 1468.933070][T14841] usb 4-1: config 0 has no interface number 0 [ 1468.939248][T14841] usb 4-1: config 0 interface 219 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1468.972766][T14841] usb 4-1: config 0 interface 219 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1468.989676][T11714] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1468.995060][T14841] usb 4-1: config 0 interface 219 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 1469.029871][T14841] usb 4-1: config 0 interface 219 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1469.053825][T14841] usb 4-1: config 0 interface 219 altsetting 0 endpoint 0xB has invalid maxpacket 62463, setting to 1024 [ 1469.092635][T14841] usb 4-1: config 0 interface 219 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 1469.105865][T14841] usb 4-1: config 0 interface 219 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1469.127338][T14841] usb 4-1: New USB device found, idVendor=108c, idProduct=0169, bcdDevice=75.ba [ 1469.142610][T14841] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1469.150899][T14841] usb 4-1: Product: syz [ 1469.171031][T14841] usb 4-1: Manufacturer: syz [ 1469.176701][T11714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1469.192649][T14841] usb 4-1: SerialNumber: syz [ 1469.206033][T11714] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1469.213921][T14841] usb 4-1: config 0 descriptor?? [ 1469.223013][T24834] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1469.230514][T11714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1469.252005][T24834] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1469.258916][T11714] usb 3-1: Product: syz [ 1469.275998][T11714] usb 3-1: Manufacturer: syz [ 1469.301403][T11714] usb 3-1: SerialNumber: syz [ 1469.338107][T11714] usb 3-1: config 0 descriptor?? [ 1469.353886][T24851] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4597'. [ 1469.499739][T24851] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4597'. [ 1469.524562][T14841] etas_es58x 4-1:0.219: Starting syz syz (Serial Number syz) [ 1469.538083][T14841] etas_es58x 4-1:0.219: could not retrieve the product info string [ 1469.684148][T14841] usb 4-1: USB disconnect, device number 119 [ 1469.691830][T14841] etas_es58x 4-1:0.219: Disconnecting syz syz [ 1469.758072][T11714] usb 3-1: USB disconnect, device number 89 [ 1469.917694][ T9803] udevd[9803]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1470.226301][T24874] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1470.552837][T11714] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1470.603830][T11742] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1470.702686][T11714] usb 4-1: Using ep0 maxpacket: 32 [ 1470.704721][T11714] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1470.726782][T11714] usb 4-1: config 0 has no interface number 0 [ 1470.726841][T11714] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1470.743753][T11714] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1470.743790][T11714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.743812][T11714] usb 4-1: Product: syz [ 1470.743830][T11714] usb 4-1: Manufacturer: syz [ 1470.743846][T11714] usb 4-1: SerialNumber: syz [ 1470.754047][T11714] usb 4-1: config 0 descriptor?? [ 1470.760525][T11714] smsc75xx v1.0.0 [ 1470.764555][T11742] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1470.764586][T11742] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1470.765939][T11742] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1470.765970][T11742] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1470.765993][T11742] usb 2-1: SerialNumber: syz [ 1470.984712][T11742] usb 2-1: 0:2 : does not exist [ 1471.046235][T11742] usb 2-1: USB disconnect, device number 86 [ 1471.057920][T11714] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1471.057957][T11714] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1471.057978][T11714] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 1471.058236][T11714] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1471.144772][T11714] usb 4-1: USB disconnect, device number 120 [ 1471.165612][T24897] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4611'. [ 1471.198296][T24897] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4611'. [ 1471.235707][T23909] udevd[23909]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1472.018701][T11714] usb 2-1: new full-speed USB device number 87 using dummy_hcd [ 1472.122929][ T24] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1472.312682][T11714] usb 2-1: device descriptor read/64, error -71 [ 1472.332622][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 1472.350756][ T24] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 1472.369023][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1472.385339][ T24] usb 3-1: config 0 has no interface number 0 [ 1472.393539][ T24] usb 3-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 1472.405551][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1472.449298][ T24] usb 3-1: config 0 descriptor?? [ 1472.582952][T11714] usb 2-1: new full-speed USB device number 88 using dummy_hcd [ 1472.803330][ T24] usb 3-1: Found UVC 0.00 device (0bd3:0555) [ 1472.813030][ T24] usb 3-1: No valid video chain found. [ 1472.923318][T11714] usb 2-1: device descriptor read/64, error -71 [ 1473.043049][T11714] usb usb2-port1: attempt power cycle [ 1473.398636][T24944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1473.415351][T24944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1473.502873][T11714] usb 2-1: new full-speed USB device number 89 using dummy_hcd [ 1473.534601][T11714] usb 2-1: device descriptor read/8, error -71 [ 1473.793439][T11714] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 1473.825821][T11714] usb 2-1: device descriptor read/8, error -71 [ 1473.933360][T11714] usb usb2-port1: unable to enumerate USB device [ 1474.012783][T24011] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1474.090592][T24950] kvm: kvm [24949]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 1474.184903][T24011] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1474.203068][T24011] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1474.216554][T24011] usb 5-1: config 0 descriptor?? [ 1474.265206][T24011] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1474.284168][T24956] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4625'. [ 1474.428956][T24959] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4625'. [ 1474.450598][T24959] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4625'. [ 1474.461161][T24959] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1474.468866][T24959] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1474.480118][T24959] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1474.491258][T24959] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1474.811535][T24011] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 1475.417522][T14841] usb 3-1: USB disconnect, device number 90 [ 1475.497971][ T5894] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 1475.585049][T24011] gspca_cpia1: usb_control_msg 02, error -71 [ 1475.591218][T24011] cpia1 5-1:0.0: only firmware version 1 is supported (got: 0) [ 1475.623402][T24011] usb 5-1: USB disconnect, device number 90 [ 1475.685697][ T5894] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1475.777317][ T5894] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1475.793620][ T5894] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 1475.813369][ T5894] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1475.824975][ T5894] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1475.847758][ T5894] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1475.866458][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1475.878945][ T5894] usb 2-1: Product: syz [ 1475.900394][ T5894] usb 2-1: Manufacturer: syz [ 1475.913149][ T5894] usb 2-1: SerialNumber: syz [ 1475.922782][T14841] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1475.939188][ T5894] usb 2-1: config 0 descriptor?? [ 1476.102688][T14841] usb 3-1: Using ep0 maxpacket: 16 [ 1476.130028][T14841] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1476.174489][T14841] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1476.186321][ T5894] radio-si470x 2-1:0.0: DeviceID=0xd318 ChipID=0x30a9 [ 1476.212804][T14841] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1476.253316][T14841] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1476.286235][T14841] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1476.302128][T14841] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1476.320313][T14841] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1476.330112][T14841] usb 3-1: Manufacturer: syz [ 1476.355263][T14841] usb 3-1: config 0 descriptor?? [ 1476.387044][ T5894] radio-si470x 2-1:0.0: software version 211, hardware version 24 [ 1476.590347][T24968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.590879][T24968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.625069][T24968] input: syz0 as /devices/virtual/input/input143 [ 1476.715539][T24974] FAULT_INJECTION: forcing a failure. [ 1476.715539][T24974] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1476.731875][T24981] kAFS: unable to lookup cell '.,c¾ûL' [ 1476.760074][T24974] CPU: 1 UID: 0 PID: 24974 Comm: syz.4.4629 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1476.760106][T24974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1476.760119][T24974] Call Trace: [ 1476.760128][T24974] [ 1476.760138][T24974] dump_stack_lvl+0x189/0x250 [ 1476.760172][T24974] ? __lock_acquire+0xaac/0xd20 [ 1476.760214][T24974] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1476.760246][T24974] ? __pfx__printk+0x10/0x10 [ 1476.760268][T24974] ? __might_fault+0xb0/0x130 [ 1476.760310][T24974] should_fail_ex+0x414/0x560 [ 1476.760339][T24974] _copy_from_iter+0x1db/0x15a0 [ 1476.760381][T24974] ? __pfx__copy_from_iter+0x10/0x10 [ 1476.760408][T24974] ? __pfx_woken_wake_function+0x10/0x10 [ 1476.760440][T24974] ? file_tty_write+0x2e6/0x990 [ 1476.760463][T24974] ? rcu_is_watching+0x15/0xb0 [ 1476.760483][T24974] ? kfree+0x4d/0x440 [ 1476.760513][T24974] file_tty_write+0x484/0x990 [ 1476.760547][T24974] vfs_write+0x548/0xa90 [ 1476.760577][T24974] ? __pfx_tty_write+0x10/0x10 [ 1476.760600][T24974] ? __pfx_vfs_write+0x10/0x10 [ 1476.760636][T24974] ? __fget_files+0x2a/0x420 [ 1476.760677][T24974] ksys_write+0x145/0x250 [ 1476.760700][T24974] ? rcu_is_watching+0x15/0xb0 [ 1476.760721][T24974] ? __pfx_ksys_write+0x10/0x10 [ 1476.760750][T24974] ? do_syscall_64+0xba/0x210 [ 1476.760782][T24974] do_syscall_64+0xf6/0x210 [ 1476.760812][T24974] ? clear_bhb_loop+0x60/0xb0 [ 1476.760838][T24974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1476.760858][T24974] RIP: 0033:0x7f9c3cb8e969 [ 1476.760877][T24974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1476.760895][T24974] RSP: 002b:00007f9c3dab8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1476.760918][T24974] RAX: ffffffffffffffda RBX: 00007f9c3cdb5fa0 RCX: 00007f9c3cb8e969 [ 1476.760934][T24974] RDX: 0000000000001006 RSI: 0000200000000040 RDI: 0000000000000004 [ 1476.760948][T24974] RBP: 00007f9c3dab8090 R08: 0000000000000000 R09: 0000000000000000 [ 1476.760960][T24974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1476.760972][T24974] R13: 0000000000000000 R14: 00007f9c3cdb5fa0 R15: 00007f9c3cedfa28 [ 1476.761004][T24974] [ 1476.838848][ T5894] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 1476.838910][ T5894] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 1476.840867][ T5894] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 1476.841248][ T5894] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 1476.862753][T14841] rc_core: IR keymap rc-hauppauge not found [ 1477.117778][ T5894] usb 2-1: USB disconnect, device number 91 [ 1477.239544][T14841] Registered IR keymap rc-empty [ 1477.245468][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.275856][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.315460][T14841] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1477.340624][T14841] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input144 [ 1477.370215][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.380770][ C0] mceusb 3-1:0.0: long-range (0x14) receiver active [ 1477.422771][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.486190][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.572857][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.723814][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.756098][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.782665][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.804929][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.844619][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.885795][T14841] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1477.938832][T14841] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1477.965145][T14841] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x14 active) [ 1477.974117][ T5894] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1478.000619][T24998] SET target dimension over the limit! [ 1478.063049][T14841] usb 3-1: USB disconnect, device number 91 [ 1478.153050][ T5894] usb 5-1: Using ep0 maxpacket: 8 [ 1478.160778][ T5894] usb 5-1: config 1 interface 0 altsetting 111 endpoint 0x81 has an invalid bInterval 247, changing to 11 [ 1478.302707][ T5894] usb 5-1: config 1 interface 0 altsetting 111 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1478.401287][ T5894] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1478.430773][ T5894] usb 5-1: New USB device found, idVendor=056a, idProduct=00d2, bcdDevice= 0.40 [ 1478.487037][ T5894] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1478.534226][ T5894] usb 5-1: Product: syz [ 1478.577887][ T5894] usb 5-1: Manufacturer: syz [ 1478.577916][ T5894] usb 5-1: SerialNumber: syz [ 1478.838075][ T5894] usbhid 5-1:1.0: can't add hid device: -71 [ 1478.838206][ T5894] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 1478.875583][ T5894] usb 5-1: USB disconnect, device number 91 [ 1479.152912][T11714] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1479.250521][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1479.476269][T11714] usb 3-1: device descriptor read/64, error -32 [ 1479.782720][T11714] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1480.002902][T11714] usb 3-1: Using ep0 maxpacket: 16 [ 1480.201700][T11714] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 1480.229749][T11714] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1480.229780][T11714] usb 3-1: config 0 has no interface number 0 [ 1480.229840][T11714] usb 3-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 1480.229866][T11714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1480.267800][T11714] usb 3-1: config 0 descriptor?? [ 1480.281449][T11714] usb 3-1: Found UVC 0.00 device (0bd3:0555) [ 1480.281490][T11714] usb 3-1: No valid video chain found. [ 1480.771189][T25046] FAULT_INJECTION: forcing a failure. [ 1480.771189][T25046] name failslab, interval 1, probability 0, space 0, times 0 [ 1480.771393][T25046] CPU: 0 UID: 0 PID: 25046 Comm: syz.3.4648 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1480.771420][T25046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1480.771433][T25046] Call Trace: [ 1480.771442][T25046] [ 1480.771452][T25046] dump_stack_lvl+0x189/0x250 [ 1480.771490][T25046] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1480.771521][T25046] ? __pfx__printk+0x10/0x10 [ 1480.771549][T25046] ? __pfx___might_resched+0x10/0x10 [ 1480.771570][T25046] ? fs_reclaim_acquire+0x7d/0x100 [ 1480.771606][T25046] should_fail_ex+0x414/0x560 [ 1480.771635][T25046] should_failslab+0xa8/0x100 [ 1480.771665][T25046] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1480.771691][T25046] ? vm_area_dup+0x28/0x540 [ 1480.771728][T25046] vm_area_dup+0x28/0x540 [ 1480.771757][T25046] ? __split_vma+0x18c/0x9b0 [ 1480.771785][T25046] __split_vma+0x1a0/0x9b0 [ 1480.771814][T25046] ? process_measurement+0x1640/0x1a40 [ 1480.771846][T25046] ? __pfx___split_vma+0x10/0x10 [ 1480.771883][T25046] ? __pfx_process_measurement+0x10/0x10 [ 1480.771907][T25046] ? tomoyo_check_open_permission+0x16a/0x3b0 [ 1480.771936][T25046] vms_gather_munmap_vmas+0x2de/0x12b0 [ 1480.771981][T25046] ? __lock_acquire+0xaac/0xd20 [ 1480.772017][T25046] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1480.772063][T25046] do_vmi_align_munmap+0x25d/0x420 [ 1480.772109][T25046] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1480.772157][T25046] ? mas_find+0x962/0xc10 [ 1480.772188][T25046] do_vmi_munmap+0x253/0x2e0 [ 1480.772217][T25046] do_munmap+0xe1/0x140 [ 1480.772249][T25046] ? __pfx_do_munmap+0x10/0x10 [ 1480.772300][T25046] mremap_to+0x56a/0x8b0 [ 1480.772333][T25046] ? __pfx_mremap_to+0x10/0x10 [ 1480.772364][T25046] ? __pfx_down_write_killable+0x10/0x10 [ 1480.772407][T25046] __se_sys_mremap+0x8ac/0xc00 [ 1480.772452][T25046] ? __pfx___se_sys_mremap+0x10/0x10 [ 1480.772473][T25046] ? ksys_write+0x1f0/0x250 [ 1480.772500][T25046] ? rcu_is_watching+0x15/0xb0 [ 1480.772527][T25046] ? do_syscall_64+0xba/0x210 [ 1480.772553][T25046] ? __x64_sys_mremap+0x20/0xc0 [ 1480.772579][T25046] do_syscall_64+0xf6/0x210 [ 1480.772607][T25046] ? clear_bhb_loop+0x60/0xb0 [ 1480.772633][T25046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1480.772653][T25046] RIP: 0033:0x7f65eb38e969 [ 1480.772672][T25046] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1480.772688][T25046] RSP: 002b:00007f65ec121038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1480.772710][T25046] RAX: ffffffffffffffda RBX: 00007f65eb5b5fa0 RCX: 00007f65eb38e969 [ 1480.772725][T25046] RDX: 0000000000600000 RSI: 0000000000009000 RDI: 0000200000000000 [ 1480.772738][T25046] RBP: 00007f65ec121090 R08: 0000200000a00000 R09: 0000000000000000 [ 1480.772752][T25046] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1480.772764][T25046] R13: 0000000000000000 R14: 00007f65eb5b5fa0 R15: 00007f65eb6dfa28 [ 1480.772797][T25046] [ 1481.285511][T14841] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1481.452908][T14841] usb 4-1: Using ep0 maxpacket: 32 [ 1481.471673][T14841] usb 4-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 1481.920869][T14841] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1481.943053][T14841] usb 4-1: Product: syz [ 1481.954044][T14841] usb 4-1: Manufacturer: syz [ 1481.971487][T14841] usb 4-1: SerialNumber: syz [ 1481.994729][T25057] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1482.016795][T14841] usb 4-1: config 0 descriptor?? [ 1482.245434][T14841] peak_usb 4-1:0.0: PEAK-System PCAN-USB Pro hwrev 0 serial 00000000.00000000 (2 channels) [ 1482.245478][T14841] peak_usb 4-1:0.0 can0: sending command failure: -22 [ 1482.245533][T14841] peak_usb 4-1:0.0 can0: sending command failure: -22 [ 1482.313945][T14841] peak_usb 4-1:0.0: probe with driver peak_usb failed with error -22 [ 1482.347603][T11714] usb 3-1: USB disconnect, device number 93 [ 1482.458101][T25049] x_tables: duplicate underflow at hook 2 [ 1482.497289][T25049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1482.497345][T25069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1482.500308][T25049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.509421][T25069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.559348][T11714] usb 4-1: USB disconnect, device number 121 [ 1483.275305][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 1483.275351][ T30] audit: type=1326 audit(1748257763.293:6103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1483.350502][T25088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1483.383027][T25088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1483.507237][ T30] audit: type=1326 audit(1748257763.333:6104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1483.656720][ T30] audit: type=1326 audit(1748257763.353:6105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1483.737531][T25102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1483.772819][ T30] audit: type=1326 audit(1748257763.353:6106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1483.775723][T25102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1483.897131][ T30] audit: type=1326 audit(1748257763.353:6107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1483.967729][T25105] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1484.139378][ T30] audit: type=1326 audit(1748257763.353:6108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1484.234999][ T30] audit: type=1326 audit(1748257763.353:6109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1484.321815][ T30] audit: type=1326 audit(1748257763.353:6110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1484.362759][ T30] audit: type=1326 audit(1748257763.363:6111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1484.474801][ T30] audit: type=1326 audit(1748257763.363:6112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25085 comm="syz.3.4659" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65eb38e969 code=0x7ffc0000 [ 1484.689981][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.696584][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.004636][T25126] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4669'. [ 1485.097442][T25126] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1485.176317][T25126] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1485.432316][T25136] input: syz0 as /devices/virtual/input/input145 [ 1485.443986][T25136] input: failed to attach handler leds to device input145, error: -6 [ 1485.930393][T25144] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4673'. [ 1486.636562][T25158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1486.670065][T25158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1487.472976][T11716] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1487.652706][T11716] usb 5-1: Using ep0 maxpacket: 8 [ 1487.690621][T11716] usb 5-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 1487.730023][T25181] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4684'. [ 1487.741470][T11716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.760535][T11716] usb 5-1: Product: syz [ 1487.778342][T11716] usb 5-1: Manufacturer: syz [ 1487.778367][T11716] usb 5-1: SerialNumber: syz [ 1487.789989][T11716] usb 5-1: config 0 descriptor?? [ 1487.855305][T25184] syzkaller1: entered promiscuous mode [ 1487.855353][T25184] syzkaller1: entered allmulticast mode [ 1487.862592][T25184] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 1488.029037][T11716] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 1488.303641][T11742] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1488.472786][T11742] usb 2-1: Using ep0 maxpacket: 8 [ 1488.491903][T11742] usb 2-1: config 0 has no interfaces? [ 1488.559915][T11742] usb 2-1: New USB device found, idVendor=1661, idProduct=0932, bcdDevice=80.ea [ 1488.619590][T11742] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1488.665247][T11742] usb 2-1: Product: syz [ 1488.669508][T11742] usb 2-1: Manufacturer: syz [ 1488.701155][T11742] usb 2-1: SerialNumber: syz [ 1488.756309][T11742] usb 2-1: config 0 descriptor?? [ 1488.991384][T25186] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1489.024384][T25186] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1489.067635][T11714] usb 2-1: USB disconnect, device number 92 [ 1489.741828][T11716] gspca_sunplus: reg_r err -71 [ 1489.756913][T11716] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 1489.778233][T11716] usb 5-1: USB disconnect, device number 92 [ 1489.800141][T25214] netlink: 'syz.5.4691': attribute type 4 has an invalid length. [ 1489.853899][ T5894] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1490.316522][T25225] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1490.338263][T25225] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1490.572592][ T5894] usb 3-1: Using ep0 maxpacket: 8 [ 1490.625220][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1490.652814][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1490.704867][ T5894] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1490.786014][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 1490.876793][ T5894] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1490.976132][ T5894] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1491.052640][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1491.078921][ T5894] usb 3-1: config 0 descriptor?? [ 1491.333713][T25215] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1491.494633][T25236] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4697'. [ 1491.533658][T25236] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1491.853831][T25236] batadv0: mtu less than device minimum [ 1491.915815][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.929133][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.941171][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.953161][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.965182][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.977514][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1491.989603][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1492.001763][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1492.013784][T25236] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1492.354125][T25248] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4700'. [ 1493.021200][T25236] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1493.486149][ T5837] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1493.739424][T25263] binder: BINDER_SET_CONTEXT_MGR already set [ 1493.758154][T25263] binder: 25258:25263 ioctl 4018620d 2000000001c0 returned -16 [ 1494.402382][T25283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1494.423536][T25284] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1494.494001][T25283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1494.541434][T25283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1494.588565][T25283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1494.608280][ T5894] usb 3-1: USB disconnect, device number 94 [ 1496.697822][T25320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1496.706891][T25320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1496.758669][T25327] program syz.2.4719 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1496.812622][T11716] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1496.949911][T25332] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4722'. [ 1496.984714][T11716] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1496.999788][T11716] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1497.029196][T11716] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1497.029225][T11716] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1497.031988][T11716] usb 4-1: config 0 descriptor?? [ 1497.054760][T24011] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1497.172277][T25344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1497.194207][T25344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1497.202645][ T5894] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1497.222787][T24011] usb 5-1: Using ep0 maxpacket: 16 [ 1497.249928][T24011] usb 5-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 1497.266034][T24011] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.302590][T24011] usb 5-1: Product: syz [ 1497.306886][T24011] usb 5-1: Manufacturer: syz [ 1497.311555][T24011] usb 5-1: SerialNumber: syz [ 1497.332263][T24011] usb 5-1: config 0 descriptor?? [ 1497.350493][T24011] as10x_usb: device has been detected [ 1497.359764][T24011] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 1497.376172][ T5894] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1497.398098][ T5894] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1497.400747][T24011] usb 5-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 1497.422312][ T5894] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1497.454688][ T5894] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1497.458259][T24011] as10x_usb: error during firmware upload part1 [ 1497.474233][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1497.482330][T24011] Registered device Sky IT Digital Key (green led) [ 1497.517978][ T5894] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1497.559534][T25326] random: crng reseeded on system resumption [ 1497.565975][ T5894] usb 2-1: invalid MIDI out EP 0 [ 1497.836181][ T5894] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1497.928885][ T5894] usb 2-1: USB disconnect, device number 93 [ 1498.186252][T25313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1498.209413][ T24] usb 5-1: USB disconnect, device number 93 [ 1498.214951][T25359] netlink: 196 bytes leftover after parsing attributes in process `syz.5.4728'. [ 1498.216725][T25313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1498.282272][ T24] Unregistered device Sky IT Digital Key (green led) [ 1498.291481][ T24] as10x_usb: device has been disconnected [ 1498.752995][ T5894] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1498.902719][ T5894] usb 2-1: Using ep0 maxpacket: 32 [ 1498.905324][ T5894] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 1498.905358][ T5894] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1498.905380][ T5894] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1498.905403][ T5894] usb 2-1: config 1 has no interface number 0 [ 1498.905447][ T5894] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1498.905483][ T5894] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1498.905529][ T5894] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1498.905555][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1498.933985][ T5894] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 1499.031431][ T5900] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1499.144863][ T5894] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 1499.202650][ T5900] usb 3-1: Using ep0 maxpacket: 16 [ 1499.220397][ T5900] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1499.220453][ T5900] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1499.226290][ T5900] usb 3-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1499.226324][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1499.226346][ T5900] usb 3-1: Product: syz [ 1499.226363][ T5900] usb 3-1: Manufacturer: syz [ 1499.226380][ T5900] usb 3-1: SerialNumber: syz [ 1499.246557][ T5900] usb 3-1: config 0 descriptor?? [ 1499.270390][T14841] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1499.423013][T14841] usb 5-1: Using ep0 maxpacket: 16 [ 1499.441837][T14841] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1499.541965][T14841] usb 5-1: config 129 has an invalid interface number: 145 but max is 0 [ 1499.542058][T14841] usb 5-1: config 129 has no interface number 0 [ 1499.542118][T14841] usb 5-1: config 129 interface 145 has no altsetting 0 [ 1499.546515][T14841] usb 5-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice= d.2f [ 1499.546581][T14841] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1499.546605][T14841] usb 5-1: Product: syz [ 1499.546623][T14841] usb 5-1: Manufacturer: syz [ 1499.546640][T14841] usb 5-1: SerialNumber: syz [ 1499.572410][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 1499.572430][ T30] audit: type=1326 audit(1748257779.583:6155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.572577][ T30] audit: type=1326 audit(1748257779.583:6156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.580561][ T30] audit: type=1326 audit(1748257779.593:6157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=27 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.580625][ T30] audit: type=1326 audit(1748257779.593:6158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.580703][ T30] audit: type=1326 audit(1748257779.593:6159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.580758][ T30] audit: type=1326 audit(1748257779.593:6160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faee198d2d0 code=0x7ffc0000 [ 1499.580835][ T30] audit: type=1326 audit(1748257779.593:6161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faee198e56b code=0x7ffc0000 [ 1499.580884][ T30] audit: type=1326 audit(1748257779.593:6162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.580930][ T30] audit: type=1326 audit(1748257779.593:6163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25361 comm="syz.1.4729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee198e969 code=0x7ffc0000 [ 1499.597284][ T5900] usb 2-1: USB disconnect, device number 94 [ 1499.599295][ T5900] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 1499.765647][T14841] usb 5-1: disable ehci-hcd to run US-144 [ 1499.807484][T14841] usb 5-1: USB disconnect, device number 94 [ 1500.118511][ C1] vkms_vblank_simulate: vblank timer overrun [ 1500.768026][T25390] FAULT_INJECTION: forcing a failure. [ 1500.768026][T25390] name failslab, interval 1, probability 0, space 0, times 0 [ 1500.802596][T25390] CPU: 0 UID: 0 PID: 25390 Comm: syz.4.4734 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1500.802629][T25390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1500.802650][T25390] Call Trace: [ 1500.802660][T25390] [ 1500.802670][T25390] dump_stack_lvl+0x189/0x250 [ 1500.802708][T25390] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1500.802739][T25390] ? __pfx__printk+0x10/0x10 [ 1500.802766][T25390] ? __pfx___might_resched+0x10/0x10 [ 1500.802787][T25390] ? fs_reclaim_acquire+0x7d/0x100 [ 1500.802823][T25390] should_fail_ex+0x414/0x560 [ 1500.802851][T25390] should_failslab+0xa8/0x100 [ 1500.802882][T25390] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1500.802908][T25390] ? vm_area_dup+0x28/0x540 [ 1500.802944][T25390] vm_area_dup+0x28/0x540 [ 1500.802978][T25390] copy_vma+0x476/0x950 [ 1500.803012][T25390] ? __pfx_copy_vma+0x10/0x10 [ 1500.803075][T25390] move_vma+0x7e6/0x16c0 [ 1500.803120][T25390] ? __pfx_move_vma+0x10/0x10 [ 1500.803143][T25390] ? mm_get_unmapped_area+0xa7/0xd0 [ 1500.803175][T25390] ? shmem_get_unmapped_area+0x2cd/0x910 [ 1500.803211][T25390] ? security_mmap_addr+0x71/0x270 [ 1500.803232][T25390] ? __get_unmapped_area+0x3e4/0x450 [ 1500.803266][T25390] ? vrm_set_new_addr+0x1a7/0x1f0 [ 1500.803292][T25390] mremap_to+0x7e7/0x8b0 [ 1500.803325][T25390] ? __pfx_mremap_to+0x10/0x10 [ 1500.803357][T25390] ? __pfx_down_write_killable+0x10/0x10 [ 1500.803398][T25390] __se_sys_mremap+0x8ac/0xc00 [ 1500.803435][T25390] ? __pfx___se_sys_mremap+0x10/0x10 [ 1500.803451][T25390] ? ksys_write+0x1f0/0x250 [ 1500.803471][T25390] ? rcu_is_watching+0x15/0xb0 [ 1500.803498][T25390] ? do_syscall_64+0xba/0x210 [ 1500.803524][T25390] ? __x64_sys_mremap+0x20/0xc0 [ 1500.803550][T25390] do_syscall_64+0xf6/0x210 [ 1500.803578][T25390] ? clear_bhb_loop+0x60/0xb0 [ 1500.803603][T25390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.803623][T25390] RIP: 0033:0x7f9c3cb8e969 [ 1500.803650][T25390] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1500.803669][T25390] RSP: 002b:00007f9c3da97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1500.803692][T25390] RAX: ffffffffffffffda RBX: 00007f9c3cdb6080 RCX: 00007f9c3cb8e969 [ 1500.803708][T25390] RDX: 0000000000600000 RSI: 0000000000009000 RDI: 0000200000000000 [ 1500.803722][T25390] RBP: 00007f9c3da97090 R08: 0000200000a00000 R09: 0000000000000000 [ 1500.803736][T25390] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1500.803746][T25390] R13: 0000000000000000 R14: 00007f9c3cdb6080 R15: 00007f9c3cedfa28 [ 1500.803771][T25390] [ 1501.512809][T11716] uclogic 0003:256C:006D.0039: failed retrieving Huion firmware version: -71 [ 1501.601500][T11716] uclogic 0003:256C:006D.0039: failed probing parameters: -71 [ 1501.651213][T11716] uclogic 0003:256C:006D.0039: probe with driver uclogic failed with error -71 [ 1501.752352][T11716] usb 4-1: USB disconnect, device number 122 [ 1501.968959][T25409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1501.983490][T25409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1502.003987][T24011] usb 3-1: USB disconnect, device number 95 [ 1502.170632][T25415] geneve1: left allmulticast mode [ 1502.259336][T25420] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1502.420791][ T5837] Bluetooth: hci1: unexpected event for opcode 0x1004 [ 1502.432855][T25424] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4742'. [ 1502.441888][T25424] netem: change failed [ 1502.457932][T25425] netlink: 220 bytes leftover after parsing attributes in process `syz.2.4739'. [ 1502.734175][T11716] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 1502.772695][T24011] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1502.913130][T11716] usb 4-1: Using ep0 maxpacket: 16 [ 1502.920441][T11716] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1502.931478][T24011] usb 2-1: device descriptor read/64, error -71 [ 1502.971968][T11716] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1503.022120][T11716] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1503.052795][T11716] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1503.077354][T11716] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1503.096823][T11716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1503.127276][T11716] usb 4-1: Product: syz [ 1503.137416][T11716] usb 4-1: Manufacturer: syz [ 1503.147572][T11716] usb 4-1: SerialNumber: syz [ 1503.183627][T24011] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1503.332754][T24011] usb 2-1: device descriptor read/64, error -71 [ 1503.427401][T11716] usb 4-1: USB disconnect, device number 123 [ 1503.453423][T24011] usb usb2-port1: attempt power cycle [ 1503.522095][T25430] FAULT_INJECTION: forcing a failure. [ 1503.522095][T25430] name failslab, interval 1, probability 0, space 0, times 0 [ 1503.556399][T12087] udevd[12087]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1503.612927][T25430] CPU: 1 UID: 0 PID: 25430 Comm: syz.4.4745 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1503.612960][T25430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1503.612975][T25430] Call Trace: [ 1503.612985][T25430] [ 1503.612994][T25430] dump_stack_lvl+0x189/0x250 [ 1503.613034][T25430] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1503.613062][T25430] ? __pfx__printk+0x10/0x10 [ 1503.613090][T25430] ? __pfx___might_resched+0x10/0x10 [ 1503.613110][T25430] ? fs_reclaim_acquire+0x7d/0x100 [ 1503.613148][T25430] should_fail_ex+0x414/0x560 [ 1503.613176][T25430] should_failslab+0xa8/0x100 [ 1503.613205][T25430] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1503.613232][T25430] ? vm_area_dup+0x28/0x540 [ 1503.613267][T25430] vm_area_dup+0x28/0x540 [ 1503.613296][T25430] ? __split_vma+0x18c/0x9b0 [ 1503.613323][T25430] __split_vma+0x1a0/0x9b0 [ 1503.613347][T25430] ? mas_next_slot+0xc20/0xcf0 [ 1503.613386][T25430] ? __pfx___split_vma+0x10/0x10 [ 1503.613438][T25430] vms_gather_munmap_vmas+0x4ab/0x12b0 [ 1503.613484][T25430] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1503.613530][T25430] do_vmi_align_munmap+0x25d/0x420 [ 1503.613572][T25430] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1503.613619][T25430] ? mas_find+0x962/0xc10 [ 1503.613649][T25430] do_vmi_munmap+0x253/0x2e0 [ 1503.613679][T25430] move_vma+0x1034/0x16c0 [ 1503.613724][T25430] ? __pfx_move_vma+0x10/0x10 [ 1503.613754][T25430] ? shmem_get_unmapped_area+0x2cd/0x910 [ 1503.613789][T25430] ? security_mmap_addr+0x71/0x270 [ 1503.613810][T25430] ? __get_unmapped_area+0x3e4/0x450 [ 1503.613844][T25430] ? vrm_set_new_addr+0x1a7/0x1f0 [ 1503.613871][T25430] mremap_to+0x7e7/0x8b0 [ 1503.613903][T25430] ? __pfx_mremap_to+0x10/0x10 [ 1503.613933][T25430] ? __pfx_down_write_killable+0x10/0x10 [ 1503.613976][T25430] __se_sys_mremap+0x8ac/0xc00 [ 1503.614020][T25430] ? __pfx___se_sys_mremap+0x10/0x10 [ 1503.614040][T25430] ? ksys_write+0x1f0/0x250 [ 1503.614064][T25430] ? rcu_is_watching+0x15/0xb0 [ 1503.614093][T25430] ? do_syscall_64+0xba/0x210 [ 1503.614118][T25430] ? __x64_sys_mremap+0x20/0xc0 [ 1503.614144][T25430] do_syscall_64+0xf6/0x210 [ 1503.614172][T25430] ? clear_bhb_loop+0x60/0xb0 [ 1503.614198][T25430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.614219][T25430] RIP: 0033:0x7f9c3cb8e969 [ 1503.614238][T25430] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1503.614256][T25430] RSP: 002b:00007f9c3dab8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1503.614278][T25430] RAX: ffffffffffffffda RBX: 00007f9c3cdb5fa0 RCX: 00007f9c3cb8e969 [ 1503.614293][T25430] RDX: 0000000000600000 RSI: 0000000000009000 RDI: 0000200000000000 [ 1503.614306][T25430] RBP: 00007f9c3dab8090 R08: 0000200000a00000 R09: 0000000000000000 [ 1503.614320][T25430] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1503.614332][T25430] R13: 0000000000000000 R14: 00007f9c3cdb5fa0 R15: 00007f9c3cedfa28 [ 1503.614365][T25430] [ 1504.045318][T24011] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1504.073331][T24011] usb 2-1: device descriptor read/8, error -71 [ 1504.272833][T11714] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1504.312681][T24011] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1504.353303][T24011] usb 2-1: device descriptor read/8, error -71 [ 1504.433384][T11714] usb 3-1: Using ep0 maxpacket: 8 [ 1504.446710][T11714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1504.459052][T11714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1504.471568][T11714] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1504.484955][T24011] usb usb2-port1: unable to enumerate USB device [ 1504.493162][T11714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 1504.505026][T11714] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1504.512792][T14841] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1504.519022][T11714] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1504.552127][T11714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1504.582613][T11742] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 1504.596868][T11714] usb 3-1: config 0 descriptor?? [ 1504.615657][T25438] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1504.742647][T11742] usb 4-1: Using ep0 maxpacket: 16 [ 1504.750046][T11742] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1504.762760][T11742] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1504.774756][T11742] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1504.788834][T11742] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1504.798495][T11742] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1504.806681][T11742] usb 4-1: Product: syz [ 1504.811584][T11742] usb 4-1: Manufacturer: syz [ 1504.816548][T11742] usb 4-1: SerialNumber: syz [ 1504.839714][T14841] usb 5-1: config 0 has no interfaces? [ 1504.867662][T25438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1504.878531][T14841] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1504.906187][T14841] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1504.913067][T25438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1504.944918][T14841] usb 5-1: Product: syz [ 1504.959607][T14841] usb 5-1: Manufacturer: syz [ 1504.969088][T14841] usb 5-1: SerialNumber: syz [ 1504.988909][T14841] usb 5-1: config 0 descriptor?? [ 1505.025582][T11714] hid (null): unknown global tag 0xf0 [ 1505.056370][T11714] hid-generic 0006:0000:0004.003A: unexpected long global item [ 1505.069822][T17390] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1505.082409][T17390] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1505.089545][T17390] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1505.096563][T17390] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1505.105757][T17390] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1505.113870][T11714] hid-generic 0006:0000:0004.003A: probe with driver hid-generic failed with error -22 [ 1505.245133][T11742] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 1506.308922][T25449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1506.415144][T25449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1506.432818][T17390] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 1506.443657][T17390] Bluetooth: hci1: Injecting HCI hardware error event [ 1506.454113][T17390] Bluetooth: hci1: hardware error 0x00 [ 1506.608619][T11742] usb 4-1: USB disconnect, device number 124 [ 1506.644343][ T6213] udevd[6213]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1506.752651][ T5837] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1507.212004][T14841] usb 3-1: USB disconnect, device number 96 [ 1507.244675][T25476] xt_hashlimit: invalid interval [ 1507.378052][T11714] usb 5-1: USB disconnect, device number 95 [ 1507.417051][T25490] FAULT_INJECTION: forcing a failure. [ 1507.417051][T25490] name failslab, interval 1, probability 0, space 0, times 0 [ 1507.470276][T25490] CPU: 1 UID: 0 PID: 25490 Comm: syz.3.4759 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1507.470307][T25490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1507.470321][T25490] Call Trace: [ 1507.470330][T25490] [ 1507.470340][T25490] dump_stack_lvl+0x189/0x250 [ 1507.470372][T25490] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1507.470394][T25490] ? __pfx__printk+0x10/0x10 [ 1507.470414][T25490] ? __pfx___might_resched+0x10/0x10 [ 1507.470433][T25490] should_fail_ex+0x414/0x560 [ 1507.470453][T25490] should_failslab+0xa8/0x100 [ 1507.470476][T25490] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1507.470495][T25490] ? mas_alloc_nodes+0x2e9/0x8e0 [ 1507.470518][T25490] mas_alloc_nodes+0x2e9/0x8e0 [ 1507.470543][T25490] mas_preallocate+0x542/0x8b0 [ 1507.470559][T25490] ? __memcg_slab_post_alloc_hook+0x211/0x820 [ 1507.470582][T25490] ? __pfx_mas_preallocate+0x10/0x10 [ 1507.470608][T25490] ? __mas_set_range+0x12f/0x3c0 [ 1507.470631][T25490] __split_vma+0x315/0x9b0 [ 1507.470656][T25490] ? __pfx___split_vma+0x10/0x10 [ 1507.470695][T25490] vms_gather_munmap_vmas+0x4ab/0x12b0 [ 1507.470727][T25490] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1507.470744][T25490] ? __pfx___might_resched+0x10/0x10 [ 1507.470771][T25490] do_vmi_align_munmap+0x25d/0x420 [ 1507.470802][T25490] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1507.470835][T25490] ? mas_find+0x962/0xc10 [ 1507.470855][T25490] do_vmi_munmap+0x253/0x2e0 [ 1507.470877][T25490] move_vma+0x1034/0x16c0 [ 1507.470908][T25490] ? __pfx_move_vma+0x10/0x10 [ 1507.470937][T25490] ? shmem_get_unmapped_area+0x2cd/0x910 [ 1507.470962][T25490] ? security_mmap_addr+0x71/0x270 [ 1507.470977][T25490] ? __get_unmapped_area+0x3e4/0x450 [ 1507.471001][T25490] ? vrm_set_new_addr+0x1a7/0x1f0 [ 1507.471019][T25490] mremap_to+0x7e7/0x8b0 [ 1507.471042][T25490] ? __pfx_mremap_to+0x10/0x10 [ 1507.471063][T25490] ? __pfx_down_write_killable+0x10/0x10 [ 1507.471094][T25490] __se_sys_mremap+0x8ac/0xc00 [ 1507.471124][T25490] ? __pfx___se_sys_mremap+0x10/0x10 [ 1507.471139][T25490] ? ksys_write+0x1f0/0x250 [ 1507.471155][T25490] ? rcu_is_watching+0x15/0xb0 [ 1507.471177][T25490] ? do_syscall_64+0xba/0x210 [ 1507.471197][T25490] ? __x64_sys_mremap+0x20/0xc0 [ 1507.471215][T25490] do_syscall_64+0xf6/0x210 [ 1507.471235][T25490] ? clear_bhb_loop+0x60/0xb0 [ 1507.471254][T25490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1507.471274][T25490] RIP: 0033:0x7f65eb38e969 [ 1507.471287][T25490] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1507.471300][T25490] RSP: 002b:00007f65e91f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1507.471317][T25490] RAX: ffffffffffffffda RBX: 00007f65eb5b6080 RCX: 00007f65eb38e969 [ 1507.471328][T25490] RDX: 0000000000600000 RSI: 0000000000009000 RDI: 0000200000000000 [ 1507.471338][T25490] RBP: 00007f65e91f6090 R08: 0000200000a00000 R09: 0000000000000000 [ 1507.471348][T25490] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1507.471357][T25490] R13: 0000000000000000 R14: 00007f65eb5b6080 R15: 00007f65eb6dfa28 [ 1507.471379][T25490] [ 1507.778655][ C1] vkms_vblank_simulate: vblank timer overrun [ 1508.462653][T24011] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1508.512841][T17390] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 1508.622690][T24011] usb 2-1: Using ep0 maxpacket: 32 [ 1508.629168][T24011] usb 2-1: too many configurations: 132, using maximum allowed: 8 [ 1508.648979][T24011] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1508.657131][T11714] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1508.664902][T24011] usb 2-1: can't read configurations, error -61 [ 1508.746348][T25516] syz.5.4770: attempt to access beyond end of device [ 1508.746348][T25516] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1508.801290][T25518] futex_wake_op: syz.2.4771 tries to shift op by 32; fix this program [ 1508.804810][T24011] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1508.821024][T11714] usb 5-1: Using ep0 maxpacket: 8 [ 1508.835522][T11714] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 1508.843766][T11714] usb 5-1: config 2 has no interface number 0 [ 1508.850212][T11714] usb 5-1: config 2 interface 31 has no altsetting 0 [ 1508.860907][T11714] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1508.870372][T11714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1508.878693][T11714] usb 5-1: Product: syz [ 1508.884124][T11714] usb 5-1: Manufacturer: syz [ 1508.888873][T11714] usb 5-1: SerialNumber: syz [ 1508.982604][T24011] usb 2-1: Using ep0 maxpacket: 32 [ 1508.989151][T24011] usb 2-1: too many configurations: 132, using maximum allowed: 8 [ 1508.999288][T24011] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1509.007223][T24011] usb 2-1: can't read configurations, error -61 [ 1509.021935][T24011] usb usb2-port1: attempt power cycle [ 1509.119792][T25507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1509.142329][T25507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1509.292754][ T24] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1509.363042][T24011] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1509.473923][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1509.485334][T11714] ch9200 5-1:2.31: probe with driver ch9200 failed with error -22 [ 1509.504558][T24011] usb 2-1: Using ep0 maxpacket: 32 [ 1509.505421][ T24] usb 3-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1509.505482][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1509.505506][ T24] usb 3-1: Product: syz [ 1509.505523][ T24] usb 3-1: Manufacturer: syz [ 1509.505540][ T24] usb 3-1: SerialNumber: syz [ 1509.507717][T24011] usb 2-1: too many configurations: 132, using maximum allowed: 8 [ 1509.508897][ T24] usb 3-1: config 0 descriptor?? [ 1509.513452][T24011] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1509.513493][T24011] usb 2-1: can't read configurations, error -61 [ 1509.548957][T11714] usb 5-1: USB disconnect, device number 96 [ 1509.682700][T24011] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1509.705166][T24011] usb 2-1: Using ep0 maxpacket: 32 [ 1509.705891][T24011] usb 2-1: too many configurations: 132, using maximum allowed: 8 [ 1509.708085][T24011] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1509.708114][T24011] usb 2-1: can't read configurations, error -61 [ 1509.708392][T24011] usb usb2-port1: unable to enumerate USB device [ 1509.761615][ T24] RobotFuzz Open Source InterFace, OSIF 3-1:0.0: version d4.15 found at bus 003 address 097 [ 1509.942808][T25531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1509.953175][T25531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1509.971749][T25520] netlink: 'syz.2.4771': attribute type 2 has an invalid length. [ 1511.864812][T25520] ave_0: entered promiscuous mode [ 1511.886762][T25559] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4780'. [ 1511.909700][T25544] gretap0: entered promiscuous mode [ 1511.928206][T25545] gretap0: left promiscuous mode [ 1512.282606][T11742] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 1512.551372][T11742] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1512.617985][T11742] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1512.669579][T11742] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1512.715017][T11742] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1512.788859][T11742] usb 2-1: config 0 descriptor?? [ 1512.814877][T25568] FAULT_INJECTION: forcing a failure. [ 1512.814877][T25568] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1512.848557][T25568] CPU: 1 UID: 0 PID: 25568 Comm: syz.3.4784 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1512.848601][T25568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1512.848614][T25568] Call Trace: [ 1512.848623][T25568] [ 1512.848633][T25568] dump_stack_lvl+0x189/0x250 [ 1512.848672][T25568] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1512.848702][T25568] ? __pfx__printk+0x10/0x10 [ 1512.848736][T25568] should_fail_ex+0x414/0x560 [ 1512.848765][T25568] _copy_to_user+0x31/0xb0 [ 1512.848800][T25568] simple_read_from_buffer+0xe1/0x170 [ 1512.848833][T25568] proc_fail_nth_read+0x1df/0x250 [ 1512.848868][T25568] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1512.848903][T25568] ? rw_verify_area+0x258/0x650 [ 1512.848927][T25568] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1512.848960][T25568] vfs_read+0x1fd/0x980 [ 1512.848990][T25568] ? __pfx___mutex_lock+0x10/0x10 [ 1512.849019][T25568] ? __pfx_vfs_read+0x10/0x10 [ 1512.849046][T25568] ? __fget_files+0x2a/0x420 [ 1512.849079][T25568] ? __fget_files+0x3a0/0x420 [ 1512.849106][T25568] ? __fget_files+0x2a/0x420 [ 1512.849143][T25568] ksys_read+0x145/0x250 [ 1512.849166][T25568] ? rcu_is_watching+0x15/0xb0 [ 1512.849188][T25568] ? __pfx_ksys_read+0x10/0x10 [ 1512.849217][T25568] ? do_syscall_64+0xba/0x210 [ 1512.849249][T25568] do_syscall_64+0xf6/0x210 [ 1512.849277][T25568] ? clear_bhb_loop+0x60/0xb0 [ 1512.849304][T25568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1512.849325][T25568] RIP: 0033:0x7f65eb38d37c [ 1512.849344][T25568] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1512.849362][T25568] RSP: 002b:00007f65e91f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1512.849385][T25568] RAX: ffffffffffffffda RBX: 00007f65eb5b6080 RCX: 00007f65eb38d37c [ 1512.849401][T25568] RDX: 000000000000000f RSI: 00007f65e91f60a0 RDI: 0000000000000004 [ 1512.849414][T25568] RBP: 00007f65e91f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1512.849427][T25568] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 [ 1512.849439][T25568] R13: 0000000000000000 R14: 00007f65eb5b6080 R15: 00007f65eb6dfa28 [ 1512.849471][T25568] [ 1513.064808][T25559] ------------[ cut here ]------------ [ 1513.077056][T25559] usb 3-1: BOGUS control dir, pipe 80006180 doesn't match bRequestType c1 [ 1513.090121][T11742] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1513.096873][T11742] dvb-usb: bulk message failed: -22 (3/0) [ 1513.107610][T25559] WARNING: CPU: 0 PID: 25559 at drivers/usb/core/urb.c:413 usb_submit_urb+0x1112/0x1870 [ 1513.118144][T25559] Modules linked in: [ 1513.123439][T25559] CPU: 0 UID: 0 PID: 25559 Comm: syz.1.4780 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1513.136495][T25559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1513.146888][T25559] RIP: 0010:usb_submit_urb+0x1112/0x1870 [ 1513.152844][T25559] Code: 0f b6 44 05 00 84 c0 0f 85 38 06 00 00 45 0f b6 04 24 48 c7 c7 a0 88 12 8c 48 8b 74 24 18 4c 89 fa 44 89 f1 e8 df d8 6e fa 90 <0f> 0b 90 90 49 bd 00 00 00 00 00 fc ff df e9 2b f4 ff ff 89 e9 80 [ 1513.163004][T25567] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1513.172891][T25559] RSP: 0018:ffffc9000bb4f870 EFLAGS: 00010246 [ 1513.172925][T25559] RAX: 090bd8d540256400 RBX: ffff888028887900 RCX: 0000000000080000 [ 1513.172944][T25559] RDX: ffffc90012306000 RSI: 000000000000d0af RDI: 000000000000d0b0 [ 1513.180695][T25567] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1513.186829][T25559] RBP: 1ffff110051b2f9c R08: 0000000000000003 R09: 0000000000000004 [ 1513.218592][T25559] R10: dffffc0000000000 R11: fffffbfff1bba984 R12: ffff888028d97ce0 [ 1513.226691][T25559] R13: dffffc0000000000 R14: 0000000080006180 R15: ffff888143af62a0 [ 1513.235112][T25559] FS: 00007faee27ab6c0(0000) GS:ffff8881260c2000(0000) knlGS:0000000000000000 [ 1513.244181][T25559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1513.250806][T25559] CR2: 000000110c336df4 CR3: 000000007801c000 CR4: 00000000003526f0 [ 1513.258889][T25559] Call Trace: [ 1513.262174][T25559] [ 1513.265173][T25559] usb_start_wait_urb+0x114/0x4c0 [ 1513.270223][T25559] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1513.275903][T25559] ? __kmalloc_noprof+0x29b/0x4f0 [ 1513.281077][T25559] usb_control_msg+0x232/0x3e0 [ 1513.286214][T25559] osif_xfer+0x21a/0x5e0 [ 1513.290531][T25559] __i2c_transfer+0x871/0x2170 [ 1513.295419][T25559] ? lockdep_hardirqs_on+0x9c/0x150 [ 1513.300774][T25559] ? __pfx___i2c_transfer+0x10/0x10 [ 1513.306357][T25559] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1513.311799][T25559] ? i2c_transfer+0x120/0x3a0 [ 1513.318456][T25559] i2c_transfer+0x25b/0x3a0 [ 1513.323129][T25559] ? __pfx_i2c_transfer+0x10/0x10 [ 1513.323161][T25559] ? _copy_from_user+0x94/0xb0 [ 1513.323199][T25559] i2cdev_ioctl_rdwr+0x460/0x740 [ 1513.338139][T25559] i2cdev_ioctl+0x64b/0x7f0 [ 1513.342732][T25559] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1513.347891][T25559] ? __fget_files+0x3a0/0x420 [ 1513.352859][T25559] ? __fget_files+0x2a/0x420 [ 1513.357515][T25559] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1513.362771][T25559] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1513.367936][T25559] __se_sys_ioctl+0xf9/0x170 [ 1513.372663][T25559] do_syscall_64+0xf6/0x210 [ 1513.377220][T25559] ? clear_bhb_loop+0x60/0xb0 [ 1513.381945][T25559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.388134][T25559] RIP: 0033:0x7faee198e969 [ 1513.392733][T25559] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1513.412460][T25559] RSP: 002b:00007faee27ab038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1513.421307][T25559] RAX: ffffffffffffffda RBX: 00007faee1bb6160 RCX: 00007faee198e969 [ 1513.429465][T25559] RDX: 0000200000002580 RSI: 0000000000000707 RDI: 000000000000000b [ 1513.437617][T25559] RBP: 00007faee1a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1513.445677][T25559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1513.453881][T25559] R13: 0000000000000000 R14: 00007faee1bb6160 R15: 00007faee1cdfa28 [ 1513.461976][T25559] [ 1513.465102][T25559] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1513.472598][T25559] CPU: 0 UID: 0 PID: 25559 Comm: syz.1.4780 Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) [ 1513.484793][T25559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1513.494891][T25559] Call Trace: [ 1513.498225][T25559] [ 1513.501170][T25559] dump_stack_lvl+0x99/0x250 [ 1513.505797][T25559] ? __asan_memcpy+0x40/0x70 [ 1513.510543][T25559] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1513.515760][T25559] ? __pfx__printk+0x10/0x10 [ 1513.520421][T25559] panic+0x2db/0x790 [ 1513.524444][T25559] ? __pfx_panic+0x10/0x10 [ 1513.528936][T25559] __warn+0x31b/0x4b0 [ 1513.532950][T25559] ? usb_submit_urb+0x1112/0x1870 [ 1513.538077][T25559] ? usb_submit_urb+0x1112/0x1870 [ 1513.543119][T25559] report_bug+0x2be/0x4f0 [ 1513.547475][T25559] ? usb_submit_urb+0x1112/0x1870 [ 1513.552539][T25559] ? usb_submit_urb+0x1112/0x1870 [ 1513.557587][T25559] ? usb_submit_urb+0x1114/0x1870 [ 1513.562625][T25559] handle_bug+0x84/0x160 [ 1513.566900][T25559] exc_invalid_op+0x1a/0x50 [ 1513.571594][T25559] asm_exc_invalid_op+0x1a/0x20 [ 1513.576542][T25559] RIP: 0010:usb_submit_urb+0x1112/0x1870 [ 1513.582227][T25559] Code: 0f b6 44 05 00 84 c0 0f 85 38 06 00 00 45 0f b6 04 24 48 c7 c7 a0 88 12 8c 48 8b 74 24 18 4c 89 fa 44 89 f1 e8 df d8 6e fa 90 <0f> 0b 90 90 49 bd 00 00 00 00 00 fc ff df e9 2b f4 ff ff 89 e9 80 [ 1513.601846][T25559] RSP: 0018:ffffc9000bb4f870 EFLAGS: 00010246 [ 1513.607936][T25559] RAX: 090bd8d540256400 RBX: ffff888028887900 RCX: 0000000000080000 [ 1513.616018][T25559] RDX: ffffc90012306000 RSI: 000000000000d0af RDI: 000000000000d0b0 [ 1513.624022][T25559] RBP: 1ffff110051b2f9c R08: 0000000000000003 R09: 0000000000000004 [ 1513.632032][T25559] R10: dffffc0000000000 R11: fffffbfff1bba984 R12: ffff888028d97ce0 [ 1513.640103][T25559] R13: dffffc0000000000 R14: 0000000080006180 R15: ffff888143af62a0 [ 1513.648117][T25559] usb_start_wait_urb+0x114/0x4c0 [ 1513.653172][T25559] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1513.659011][T25559] ? __kmalloc_noprof+0x29b/0x4f0 [ 1513.664087][T25559] usb_control_msg+0x232/0x3e0 [ 1513.668913][T25559] osif_xfer+0x21a/0x5e0 [ 1513.673293][T25559] __i2c_transfer+0x871/0x2170 [ 1513.678688][T25559] ? lockdep_hardirqs_on+0x9c/0x150 [ 1513.683999][T25559] ? __pfx___i2c_transfer+0x10/0x10 [ 1513.689209][T25559] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1513.694605][T25559] ? i2c_transfer+0x120/0x3a0 [ 1513.699390][T25559] i2c_transfer+0x25b/0x3a0 [ 1513.703906][T25559] ? __pfx_i2c_transfer+0x10/0x10 [ 1513.709031][T25559] ? _copy_from_user+0x94/0xb0 [ 1513.713906][T25559] i2cdev_ioctl_rdwr+0x460/0x740 [ 1513.718900][T25559] i2cdev_ioctl+0x64b/0x7f0 [ 1513.723552][T25559] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1513.728791][T25559] ? __fget_files+0x3a0/0x420 [ 1513.733605][T25559] ? __fget_files+0x2a/0x420 [ 1513.738218][T25559] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1513.743323][T25559] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1513.748359][T25559] __se_sys_ioctl+0xf9/0x170 [ 1513.752961][T25559] do_syscall_64+0xf6/0x210 [ 1513.757520][T25559] ? clear_bhb_loop+0x60/0xb0 [ 1513.762216][T25559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.768203][T25559] RIP: 0033:0x7faee198e969 [ 1513.772631][T25559] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1513.792364][T25559] RSP: 002b:00007faee27ab038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1513.800991][T25559] RAX: ffffffffffffffda RBX: 00007faee1bb6160 RCX: 00007faee198e969 [ 1513.808979][T25559] RDX: 0000200000002580 RSI: 0000000000000707 RDI: 000000000000000b [ 1513.816967][T25559] RBP: 00007faee1a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1513.824969][T25559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1513.832951][T25559] R13: 0000000000000000 R14: 00007faee1bb6160 R15: 00007faee1cdfa28 [ 1513.840982][T25559] [ 1513.851641][T25559] Kernel Offset: disabled [ 1513.856070][T25559] Rebooting in 86400 seconds..