last executing test programs: 3m11.039704623s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a69700000000500040000000000240007800c00028008000140ffffffff0c00018008000140e000000205001400020000000500050002000000050001000600"/108], 0x6c}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=@newtaction={0x14, 0x32, 0x1}, 0x14}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) writev(r2, &(0x7f0000002680)=[{&(0x7f00000025c0)='8', 0x1}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.events.local\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @empty, 0x15, 0x3, 'wrr\x00', 0x9, 0x4, 0x8}, 0x2c) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000480)=ANY=[@ANYBLOB="3000000002030101000000000000000001000001080003400000000609000200ffff2f63020000000800010001000010cd7f96c6b20dca8451663cafeb062da857f3c09bb5214c22fcf9f97b02175f3401dc516c112e2e7493c4d341283a0edd323bf8afa94ec17ca9d82da2dc1ab59f159eb585473a43d0c56a8a9aca00ecd73b528a80ed7000cbd58ea2226cfca36a8c5f2636b50bd09a2cb3aa82366b2d01cebeb6"], 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x800) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x3c, 0x2c, 0x2, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff0, 0xe}, {}, {0x7, 0xe}}, [@TCA_CHAIN={0x8, 0xb, 0x32c}, @filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x40000) socket$unix(0x1, 0x1, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0xd53e}, 0x8) 2m53.891544682s ago: executing program 32 (id=2): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a69700000000500040000000000240007800c00028008000140ffffffff0c00018008000140e000000205001400020000000500050002000000050001000600"/108], 0x6c}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=@newtaction={0x14, 0x32, 0x1}, 0x14}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) writev(r2, &(0x7f0000002680)=[{&(0x7f00000025c0)='8', 0x1}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.events.local\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @empty, 0x15, 0x3, 'wrr\x00', 0x9, 0x4, 0x8}, 0x2c) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000480)=ANY=[@ANYBLOB="3000000002030101000000000000000001000001080003400000000609000200ffff2f63020000000800010001000010cd7f96c6b20dca8451663cafeb062da857f3c09bb5214c22fcf9f97b02175f3401dc516c112e2e7493c4d341283a0edd323bf8afa94ec17ca9d82da2dc1ab59f159eb585473a43d0c56a8a9aca00ecd73b528a80ed7000cbd58ea2226cfca36a8c5f2636b50bd09a2cb3aa82366b2d01cebeb6"], 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x800) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x3c, 0x2c, 0x2, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff0, 0xe}, {}, {0x7, 0xe}}, [@TCA_CHAIN={0x8, 0xb, 0x32c}, @filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x40000) socket$unix(0x1, 0x1, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0xd53e}, 0x8) 23.608601246s ago: executing program 0 (id=285): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0x52000775) open(&(0x7f00000000c0)='.\x00', 0x800, 0x50) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000be5000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r4, 0x838a3000) ioctl$MON_IOCT_RING_SIZE(r4, 0x9204, 0xfda86) r5 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r6, r7, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x0, @fd_index=0x5, 0x0, 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) io_uring_enter(r5, 0x26c3, 0xdffffffb, 0x4c, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf259900000008000300", @ANYRES32=r2], 0x1c}}, 0x40084) msgsnd(0x0, &(0x7f00000001c0)=ANY=[], 0x401, 0x0) msgsnd(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x8, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1000}, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) r9 = msgget(0x1, 0x80) msgrcv(r9, &(0x7f0000000240)={0x0, ""/29}, 0x25, 0x1, 0x800) msgrcv(0x0, &(0x7f00000002c0), 0x8, 0x0, 0x800) syz_usb_connect(0x0, 0x57, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000036b40f202104a000e1c80000000109024500010000000009040000020202ff00052406000105240000000d240f010000000000f2ff000006241a000000042402"], 0x0) msgsnd(0x0, &(0x7f0000000080)={0x0, "d8fee98e8459f17334e7a081f676e4f6c9e0cc2454bdfffabc12c66e9661bff95c341eb3af4e5942dce82e3be0b56ed6f4f9cebcd00fa28d09da22de59cbaf5fe80a3055994e6ba6f68ba6923ccc7c86540c71034ae3bae349e0b051523320d233ce96c8e92313a2100ce3b51825ea056dee9d5e98ec8d129a1c8f136103d17f46f47cee8aeb5622db7a48e9967ad67605762d31451f55221df7bcef854396e617da40eb28600d532d524b4242887ca93f581507af98273dd47a52f0be909fb17945a5d2f339656f2da1f35002322941e2e89f12010e0b5b11b1"}, 0xe2, 0x0) 19.534094039s ago: executing program 0 (id=296): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000300)="0fc71c3e2e0f09b8010000000f01d92e360f01cfb805000000b9003000000f01c1b9800000c00f3235002000000f300f01cfb930030000b800800000ba000000000f302e0f015d0b66b801018ed8", 0x4e}], 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_pts(0xffffffffffffffff, 0x4142) ioctl$GIO_FONT(r3, 0x4b60, &(0x7f0000000640)=""/151) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) add_key(&(0x7f00000002c0)='cifs.idmap\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c001480080011"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x258, r6, 0x800, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_HEAD={0x241, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x5}, @device_a, @device_a, @random="20fccc414c9b", {0x7, 0x2}, @value=@ver_80211n={0x0, 0x5f00, 0x2, 0x2, 0x0, 0x2, 0x1, 0x0, 0x1}}, 0x0, @default, 0x1220, @val={0x0, 0x6, @default_ap_ssid}, @val, @val={0x3, 0x1, 0xb6}, @val={0x4, 0x6, {0xff, 0x1, 0x5, 0x9}}, @void, @val={0x5, 0x3a, {0x3, 0x6b, 0x7, "288a98f0a161682afadf4aa10ee5d11baf642a32f1df437b0909c412ebbfd888315c2bd9ab4b75ab84ba13beae8be249f0490ab9d21135"}}, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0xe, 0x87, 0x4}}, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x1, 0x1, 0x1, 0x0, 0x20}}, @val={0x76, 0x6, {0xd, 0x2, 0x15, 0x100}}, [{0xdd, 0xaf, "d13e96eb34f67c2aee0b5cc7f021a3d8d377c2534dafc58e6d25d982f986ba2f71961e9cd5423beaa33c4cea1c9fa7ee53c8bd406f20f23ee9cc7e3a18be82ddb5d771c931a76245308fb8ed01c32f7584bc890f2c20dbd64fe3c9808aa48ae87441a1b6850ba0453a66975778fb100b77ee34e7b3c4d1acbc5908718005453e954bc77a55243d276285ac654997a334acb79e933c28e2d176a08fa883e1bf312bc7856930cb17c80cb66c22d833b1"}, {0xdd, 0x36, "b938cdf0ca0a320d905e2cc7f749f3530e10ad1aab5508e1d3d9edcd2628cb7b0fda69da6f58979f16b0838f9e744006ddd83e2eb3e8"}, {0xdd, 0xb7, "a066e0a1e5d06280fa0e0f01550ec1c540b51f3c469aa99da9b23f3e068b90d2f20e8f9b88e8efd06af40eefd9f095a0c79ff6af204e339b922fb2482292fc08198e3601f65fe699bf86b36ca6729a7f4ec7d68e98001af5ffb1a62efb187006ae5bea6f40b4eb3b7f0bd327b89476e13c41b1ee7b87186eb536296342fad3e20cb7a0734334a311e88338300c428071dad11146c017ea6383adedb3b6c7b7df292b2cc9433aa09b6ef224f0a4034677e99462bcf60c88"}]}}]}, 0x258}, 0x1, 0x0, 0x0, 0x20000080}, 0x10) clock_gettime(0x0, &(0x7f0000000000)) r7 = syz_open_dev$vim2m(&(0x7f0000000580), 0x5, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000100)={0x6, 0x4, 0x2, 0x0, 0x3}) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 18.308274478s ago: executing program 2 (id=300): r0 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315f9b10102030109026100010000000009040001"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="390000fa461aa0fbe8ab80679467df91c09e8a722e", 0x15}], 0x1) r1 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x8842) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x8300, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000040)={'vlan0\x00'}) setreuid(0x0, 0xee00) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x1000}}) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) read$FUSE(r3, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, &(0x7f0000002300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c272074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba4850439ec125b708ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca36507002b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x130, 0xfffffffffffffffe, 0xb2b, {0x1, 0x8000008, 0x0, '\x00', {0x1, 0x38c, 0x6, 0x10003, r5, r6, 0x0, '\x00', 0xd, 0x6, 0x100000000, 0xfffffffffffff000, {0x6, 0x6}, {0x20000000000004, 0xfffffffe}, {0xb12e, 0x8fc}, {0x8001, 0xa04}, 0x4000007, 0x80020b, 0x5, 0x6}}}}) write$FUSE_INIT(r3, &(0x7f0000001200)={0x50, 0x0, r4, {0x7, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}}, 0x50) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r1]) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r7 = memfd_create(&(0x7f0000000000)='\xff\x00l\x1e\xa0,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[\x93\xfe{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG', 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2000001, 0x4c092, r7, 0x0) fallocate(r7, 0x3, 0x7, 0xfffffffb) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 13.491951632s ago: executing program 2 (id=309): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x4, r3}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) keyctl$update(0x2, r5, &(0x7f0000000140)="c4e3dec654f5b002f54b64d941f2", 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/mdstat\x00', 0x0, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x1fa}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r9 = openat$userio(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) pwritev(r9, &(0x7f0000000400)=[{&(0x7f0000000380)="49db", 0x2}], 0x1, 0xfffffc00, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c000000100003052cbd7000fedbdf250000", @ANYRES32=0x0, @ANYBLOB="0000000000080400240012800b0001006d616373656300001400028005000b000000000005000f000000000008000500", @ANYRES32=r10], 0x4c}}, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x48, 0x0, @fd=r6, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) 12.285174144s ago: executing program 2 (id=310): r0 = syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x2000000) r5 = syz_open_dev$sndpcmc(&(0x7f0000000480), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r5, 0xc1004110, &(0x7f0000000000)={0x0, [0x6, 0xffff1337, 0x3], [{0x0, 0x0, 0x0, 0x1}, {0x35, 0x39}, {0x0, 0x8}, {0x800000, 0x800001}, {0xffff}, {0x1ff}, {0x0, 0x1000}, {}, {}, {}, {}, {0x0, 0xe68b}], 0xc}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r6, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r8, r7, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x48083) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000031000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 11.893865979s ago: executing program 4 (id=311): r0 = shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ff9000/0x2000)=nil) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT_ANY(r0, 0xf, 0x0) 11.543260354s ago: executing program 0 (id=312): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x8, 0xdd, 0xff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x8000, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c250000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r1}, 0x18) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, 0x0, 0x0}, 0x94) 11.542265885s ago: executing program 4 (id=314): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0x52000775) open(&(0x7f00000000c0)='.\x00', 0x800, 0x50) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000be5000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r4, 0x838a3000) ioctl$MON_IOCT_RING_SIZE(r4, 0x9204, 0xfda86) r5 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r6, r7, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x0, @fd_index=0x5, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB], 0x48) io_uring_enter(r5, 0x26c3, 0xdffffffb, 0x4c, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf259900000008000300", @ANYRES32=r2], 0x1c}}, 0x40084) msgsnd(0x0, &(0x7f00000001c0)=ANY=[], 0x401, 0x0) msgsnd(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x8, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1000}, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) r9 = msgget(0x1, 0x80) msgrcv(r9, &(0x7f0000000240)={0x0, ""/29}, 0x25, 0x1, 0x800) msgrcv(0x0, &(0x7f00000002c0), 0x8, 0x0, 0x800) syz_usb_connect(0x0, 0x57, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000036b40f202104a000e1c80000000109024500010000000009040000020202ff00052406000105240000000d240f010000000000f2ff000006241a000000042402"], 0x0) msgsnd(0x0, &(0x7f0000000080)={0x0, "d8fee98e8459f17334e7a081f676e4f6c9e0cc2454bdfffabc12c66e9661bff95c341eb3af4e5942dce82e3be0b56ed6f4f9cebcd00fa28d09da22de59cbaf5fe80a3055994e6ba6f68ba6923ccc7c86540c71034ae3bae349e0b051523320d233ce96c8e92313a2100ce3b51825ea056dee9d5e98ec8d129a1c8f136103d17f46f47cee8aeb5622db7a48e9967ad67605762d31451f55221df7bcef854396e617da40eb28600d532d524b4242887ca93f581507af98273dd47a52f0be909fb17945a5d2f339656f2da1f35002322941e2e89f12010e0b5b11b1"}, 0xe2, 0x0) 11.242351832s ago: executing program 0 (id=315): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0xff2e) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) write$uinput_user_dev(r1, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x8, 0x7fffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x2]}, 0x45c) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000580)={0x0, 0x0, 0x3, 0x0, 0x1b, "00000000000000000000ffff00"}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0xfffffffd, 0x0, 0x6, 0x1, "e315bc1cc24ff7b7cdb242e1ff0aa6905446b3"}) r2 = syz_open_pts(r0, 0x0) r3 = dup3(r2, r0, 0x0) read$watch_queue(r3, &(0x7f0000000340)=""/133, 0x85) 9.998019319s ago: executing program 2 (id=317): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000180)={0x1}, 0x0) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020600) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000240)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4004) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f00000001c0)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) 9.967761731s ago: executing program 0 (id=318): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x44f, 0xb654, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)={0x38, r3, 0x30d, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0xffffffffffffff93}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}]}, 0x38}}, 0x0) write$UHID_CREATE(r1, &(0x7f00000000c0)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', 0x0, 0x0, 0x7, 0xfffffff8, 0xfff, 0x7, 0x7ff}}, 0x120) ioctl$AUTOFS_IOC_FAIL(r1, 0x9361, 0x8) syz_usb_connect$cdc_ecm(0x5, 0x4d, &(0x7f0000000700)={{0x12, 0x1, 0x240, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x5, 0xb0, 0x9, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x91, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x2, 0x4, 0x81}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x7, 0x7, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x1, 0x7, 0x9}}}}}]}}]}}, 0x0) read(r1, &(0x7f0000000980)=""/203, 0xcb) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5c"], 0xffdd) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x22, 0x5, {[@local=@item_012={0x2, 0x2, 0x0, "d81a"}, @global=@item_012={0x1, 0x1, 0x1, "93"}]}}, 0x0}, 0x0) capset(&(0x7f00000002c0)={0x19980330}, &(0x7f0000000300)={0x8, 0x7f, 0xfffffffb, 0x4, 0xffff2941, 0xfffffff8}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = accept4$x25(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000240)=0x12, 0x1000) ioctl$SIOCX25GDTEFACILITIES(r6, 0x89ea, &(0x7f0000000280)) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000500)='lp', 0x2) 9.302862011s ago: executing program 5 (id=319): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000000)=@req3={0xf813, 0x3, 0x2, 0x81, 0x7, 0x1, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000000000000010000000200009f", @ANYRES32, @ANYRES32=r0], 0x60, 0x20004080}, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x201, 0x1, 0x1}, 0x1c) recvmsg$unix(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 9.190498497s ago: executing program 2 (id=320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000380)={'vlan0\x00', 0x77a7}) r2 = socket$kcm(0x2, 0x3, 0x2) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x60, 0xdd, 0x99, 0x20, 0x5e9, 0x9, 0x73db, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb6, 0x7, 0x0, 0x9, 0xbd, 0x2e}}]}}]}}, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x100, 0x0) mq_notify(r4, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) mq_notify(r4, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000900)={0x44, &(0x7f00000003c0)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, &(0x7f0000000380)={0x14, &(0x7f0000000240)=ANY=[@ANYBLOB="200399000000993049ae4bf687ed2a699577595a3ba833415845d93a2fca3bda7f02adce0ce5a33c006691da39a7fa6f5784dfd96fa45a9d95a01e780d6008ee3cdadd16dcf12bfdde6bfe23fe9c9bc01068926b300aae7b620c06c5ed9e76cfaa47d954eb5bd16d2abd835c127f228921f3991c738442f03701afe61c60c488b28b263ce40a1b9dd2bfa8e54f9521cc7a7b056185388e6d84a7bbd024937e"], &(0x7f0000000300)={0x0, 0x3, 0x51, @string={0x51, 0x3, "4e7a23ffe0849c491226cbee3f289c5d521f96385088851867a6e86e3d03936e3d9bf57b1049e091bdf23e263aa95464383a299321d406e5ea4a2e85b5010e2e8cdf7b4c0de7745cd136f80f88df98"}}}, &(0x7f00000005c0)={0x34, &(0x7f0000000400)={0x40, 0x31, 0x4b, "dd466e0123972f63eab388f016d50a7fed418ed727802da24124b387e58c46f95f8ac5edef54425c093141edb1661c1bd907a5ebdae8965ae687bd5a4ea2b842cfb9183538a15b149da5ba"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0xff}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0x85}, &(0x7f0000000500)={0xc0, 0xa1, 0x4, 0x2}, &(0x7f0000000540)={0x40, 0xa0, 0x4}, &(0x7f0000000580)={0xc0, 0xa2, 0x2f, "b1e2a370552777470423762ae96cc452107dd93463e5db7b12ac42871f3e68f3bf9b0baaa9228021818f76f1b62309"}}) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYRES64=r6, @ANYBLOB='5', @ANYBLOB="e7f9c0b5d860780b3cbf3c081b7aa35445d274b74fd69daa6789007759db9cd5fd11f2e5e5c055d85065b8f2f0b8a86babb92603889a5cc38dc1bb98ce0350b4d219ee1c7b68625b45797fcb5dcc00745f2a6fdd7277415d430bdc80d891ee400428416c8b5ebfb4b12dadb75bac572a039b4fd8eead86106d7d69fda1548c37a7e3f7ec6d41efef48271b45c4b324ab00883b59c4252ed583551161af761d681ff5f3d3aa66631bbb777ae30ad9d270351ab4204776630aef0ecb3f07cbf19aa8aa3ba85e1d88533c41e152a5bdd4f6be43f3160825674f724bfacb3addfafd0377f63125ff08ef143242", @ANYRESHEX=r0], 0x73) 8.799521888s ago: executing program 3 (id=322): r0 = syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000000c0605000000000000000000020000030900020073797a30000000000500010007000000050001"], 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x2000000) r6 = syz_open_dev$sndpcmc(&(0x7f0000000480), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r6, 0xc1004110, &(0x7f0000000000)={0x0, [0x6, 0xffff1337, 0x3], [{0x0, 0x0, 0x0, 0x1}, {0x35, 0x39}, {0x0, 0x8}, {0x800000, 0x800001}, {0xffff}, {0x1ff}, {0x0, 0x1000}, {}, {}, {}, {}, {0x0, 0xe68b}], 0xc}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r8, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r7, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r9, r8, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r8, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x48083) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0xc, 0x0, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.726173795s ago: executing program 5 (id=323): r0 = socket$inet6(0xa, 0x80001, 0x0) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) process_mrelease(r1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000640)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}}}, 0x108) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000005000000003a00000008000300", @ANYRES32=r5, @ANYBLOB="05005b"], 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r10, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r10, 0x0) ioctl$KVM_X86_SETUP_MCE(r10, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0xa13ca8e5839881a5, 0x14}) sendmmsg$inet6(r9, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, 'k'}]}, 0x24}}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 7.583488092s ago: executing program 3 (id=324): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000300)="0fc71c3e2e0f09b8010000000f01d92e360f01cfb805000000b9003000000f01c1b9800000c00f3235002000000f300f01cfb930030000b800800000ba000000000f302e0f015d0b66b801018ed8", 0x4e}], 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_pts(0xffffffffffffffff, 0x4142) ioctl$GIO_FONT(r3, 0x4b60, &(0x7f0000000640)=""/151) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) add_key(&(0x7f00000002c0)='cifs.idmap\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c001480080011"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x264, r6, 0x800, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_HEAD={0x24d, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x5}, @device_a, @device_a, @random="20fccc414c9b", {0x7, 0x2}, @value=@ver_80211n={0x0, 0x5f00, 0x2, 0x2, 0x0, 0x2, 0x1, 0x0, 0x1}}, 0x0, @default, 0x1220, @val={0x0, 0x6, @default_ap_ssid}, @val, @val={0x3, 0x1, 0xb6}, @val={0x4, 0x6, {0xff, 0x1, 0x5, 0x9}}, @void, @val={0x5, 0x3a, {0x3, 0x6b, 0x7, "288a98f0a161682afadf4aa10ee5d11baf642a32f1df437b0909c412ebbfd888315c2bd9ab4b75ab84ba13beae8be249f0490ab9d21135"}}, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0xe, 0x87, 0x4}}, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x1, 0x1, 0x1, 0x0, 0x20}}, @val={0x76, 0x6, {0xd, 0x2, 0x15, 0x100}}, [{0xdd, 0xbb, "d13e96eb34f67c2aee0b5cc7f021a3d8d377c2534dafc58e6d25d982f986ba2f71961e9cd5423beaa33c4cea1c9fa7ee53c8bd406f20f23ee9cc7e3a18be82ddb5d771c931a76245308fb8ed01c32f7584bc890f2c20dbd64fe3c9808aa48ae87441a1b6850ba0453a66975778fb100b77ee34e7b3c4d1acbc5908718005453e954bc77a55243d276285ac654997a334acb79e933c28e2d176a08fa883e1bf312bc7856930cb17c80cb66c22d833b1fa61e8f162683c784dc2e9d4"}, {0xdd, 0x36, "b938cdf0ca0a320d905e2cc7f749f3530e10ad1aab5508e1d3d9edcd2628cb7b0fda69da6f58979f16b0838f9e744006ddd83e2eb3e8"}, {0xdd, 0xb7, "a066e0a1e5d06280fa0e0f01550ec1c540b51f3c469aa99da9b23f3e068b90d2f20e8f9b88e8efd06af40eefd9f095a0c79ff6af204e339b922fb2482292fc08198e3601f65fe699bf86b36ca6729a7f4ec7d68e98001af5ffb1a62efb187006ae5bea6f40b4eb3b7f0bd327b89476e13c41b1ee7b87186eb536296342fad3e20cb7a0734334a311e88338300c428071dad11146c017ea6383adedb3b6c7b7df292b2cc9433aa09b6ef224f0a4034677e99462bcf60c88"}]}}]}, 0x264}, 0x1, 0x0, 0x0, 0x20000080}, 0x10) clock_gettime(0x0, &(0x7f0000000000)) r7 = syz_open_dev$vim2m(&(0x7f0000000580), 0x5, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000100)={0x6, 0x4, 0x2, 0x0, 0x3}) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.582561354s ago: executing program 4 (id=325): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x8, 0xdd, 0xff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x8000, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c250000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r1}, 0x18) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, 0x0, 0x0}, 0x94) 7.442869529s ago: executing program 4 (id=326): socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008040}, 0x20000800) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_vhci(&(0x7f0000000480)=@HCI_EVENT_PKT={0x4, @extended_inquiry_info={{0x2f, 0xff}, {0x1, [{@none, 0xc5, 0x6, "a20ff2", 0x40, 0xa, "158a46d8878355d69d80bcad461eb8937072a029883ee014782235f5d12907289ec960ad1b0f944008f27882b4dd173614a12c68f2aee9ed5989b2ff5ea52634b951f5d5237459c611e78132e07edc01474122154ed10804c04344dbd61906bd4fbcbd0541b6c547f5691e263c3e011259a419ec1c5e75a132d2222da87a6f4b52854349563b352a333f14a61debac538b7c058ffeae008910019e2bf336e4b1b33ab7836835134f6574be354dd416546e1ec8d11f4677f53144a7e7d217428ddd6f49e0d71559476f35953712ebd6eb0133113e374e98069b1e3b94c043e59e2759eb2a0b59531854ff4199fbe1a79d"}]}}}, 0x102) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/cgroup\x00') socket$igmp6(0xa, 0x3, 0x2) eventfd2(0x1, 0x1) close(0x3) io_uring_setup(0x1696, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_SET(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000300)={0x2c, r5, 0x1, 0x70bd26, 0x25df9bfc, {}, [@ETHTOOL_A_EEE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}]}]}, 0x2c}}, 0x40814) io_submit(0x0, 0x1, &(0x7f0000000580)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000}]) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24044000}], 0x1, 0x4c851) 7.318169513s ago: executing program 5 (id=327): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, 0x0, 0x0) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020600) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000240)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4004) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f00000001c0)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) 6.006656184s ago: executing program 4 (id=328): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, 0x0, 0x0) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020600) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000240)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4004) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f00000001c0)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) 5.961816957s ago: executing program 5 (id=329): socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008040}, 0x20000800) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_vhci(0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/cgroup\x00') socket$igmp6(0xa, 0x3, 0x2) eventfd2(0x1, 0x1) close(0x3) io_uring_setup(0x1696, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_SET(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000300)={0x2c, r5, 0x1, 0x70bd26, 0x25df9bfc, {}, [@ETHTOOL_A_EEE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}]}]}, 0x2c}}, 0x40814) io_setup(0x42, 0x0) io_submit(0x0, 0x1, &(0x7f0000000580)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000}]) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24044000}], 0x1, 0x4c851) 3.476370056s ago: executing program 5 (id=330): r0 = syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x2000000) r5 = syz_open_dev$sndpcmc(&(0x7f0000000480), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r5, 0xc1004110, &(0x7f0000000000)={0x0, [0x6, 0xffff1337, 0x3], [{0x0, 0x0, 0x0, 0x1}, {0x35, 0x39}, {0x0, 0x8}, {0x800000, 0x800001}, {0xffff}, {0x1ff}, {0x0, 0x1000}, {}, {}, {}, {}, {0x0, 0xe68b}], 0xc}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r6, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r8, r7, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x48083) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000031000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.260290252s ago: executing program 0 (id=331): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000300)="0fc71c3e2e0f09b8010000000f01d92e360f01cfb805000000b9003000000f01c1b9800000c00f3235002000000f300f01cfb930030000b800800000ba000000000f302e0f015d0b66b801018ed8", 0x4e}], 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_pts(0xffffffffffffffff, 0x4142) ioctl$GIO_FONT(r3, 0x4b60, &(0x7f0000000640)=""/151) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) add_key(&(0x7f00000002c0)='cifs.idmap\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c001480080011"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x258, r6, 0x800, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_HEAD={0x241, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x5}, @device_a, @device_a, @random="20fccc414c9b", {0x7, 0x2}, @value=@ver_80211n={0x0, 0x5f00, 0x2, 0x2, 0x0, 0x2, 0x1, 0x0, 0x1}}, 0x0, @default, 0x1220, @val={0x0, 0x6, @default_ap_ssid}, @val, @val={0x3, 0x1, 0xb6}, @val={0x4, 0x6, {0xff, 0x1, 0x5, 0x9}}, @void, @val={0x5, 0x3a, {0x3, 0x6b, 0x7, "288a98f0a161682afadf4aa10ee5d11baf642a32f1df437b0909c412ebbfd888315c2bd9ab4b75ab84ba13beae8be249f0490ab9d21135"}}, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0xe, 0x87, 0x4}}, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x1, 0x1, 0x1, 0x0, 0x20}}, @val={0x76, 0x6, {0xd, 0x2, 0x15, 0x100}}, [{0xdd, 0xaf, "d13e96eb34f67c2aee0b5cc7f021a3d8d377c2534dafc58e6d25d982f986ba2f71961e9cd5423beaa33c4cea1c9fa7ee53c8bd406f20f23ee9cc7e3a18be82ddb5d771c931a76245308fb8ed01c32f7584bc890f2c20dbd64fe3c9808aa48ae87441a1b6850ba0453a66975778fb100b77ee34e7b3c4d1acbc5908718005453e954bc77a55243d276285ac654997a334acb79e933c28e2d176a08fa883e1bf312bc7856930cb17c80cb66c22d833b1"}, {0xdd, 0x36, "b938cdf0ca0a320d905e2cc7f749f3530e10ad1aab5508e1d3d9edcd2628cb7b0fda69da6f58979f16b0838f9e744006ddd83e2eb3e8"}, {0xdd, 0xb7, "a066e0a1e5d06280fa0e0f01550ec1c540b51f3c469aa99da9b23f3e068b90d2f20e8f9b88e8efd06af40eefd9f095a0c79ff6af204e339b922fb2482292fc08198e3601f65fe699bf86b36ca6729a7f4ec7d68e98001af5ffb1a62efb187006ae5bea6f40b4eb3b7f0bd327b89476e13c41b1ee7b87186eb536296342fad3e20cb7a0734334a311e88338300c428071dad11146c017ea6383adedb3b6c7b7df292b2cc9433aa09b6ef224f0a4034677e99462bcf60c88"}]}}]}, 0x258}, 0x1, 0x0, 0x0, 0x20000080}, 0x10) clock_gettime(0x0, &(0x7f0000000000)) r7 = syz_open_dev$vim2m(&(0x7f0000000580), 0x5, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000100)={0x6, 0x4, 0x2, 0x0, 0x3}) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.257684056s ago: executing program 4 (id=332): syz_open_dev$I2C(0x0, 0x0, 0x2080) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0900000004000000e27f00000100000012000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000010cb9c5b8300000000ff0000000000f2330d5f64bed90000000000000000000081"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x12e010, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x1c, r4, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2060, 0x0) r8 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x408042, 0xbe599c78853d95a5) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r9}, 0x10) fcntl$setlease(r8, 0x400, 0x1) setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000180)={0x4, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 2.582362712s ago: executing program 3 (id=333): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000000)=@req3={0xf813, 0x3, 0x2, 0x81, 0x7, 0x1, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000000000000010000000200009f", @ANYRES32, @ANYRES32=r0], 0x60, 0x20004080}, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x201, 0x1, 0x1}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) 2.281460146s ago: executing program 3 (id=334): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/comedi2\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(0xffffffffffffffff, 0x40309410, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x8}, 0x10) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x80fe) socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x210000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360", 0x41}], 0x1}], 0x1, 0x40800) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/snmp6\x00') read$FUSE(r2, &(0x7f0000000640)={0x2020}, 0x2020) unshare(0x2c020400) r3 = msgget$private(0x0, 0x722) msgsnd(r3, &(0x7f0000000980)=ANY=[], 0x8, 0x800) msgsnd(0x0, &(0x7f0000000180)=ANY=[], 0x2000, 0x0) msgrcv(r3, 0x0, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = userfaultfd(0x801) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000001, 0x5d032, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r6, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$UFFDIO_COPY(r5, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file0\x00', 0x0, 0x10}, 0x18) 2.24404594s ago: executing program 2 (id=335): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0x52000775) open(&(0x7f00000000c0)='.\x00', 0x800, 0x50) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000be5000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r4, 0x838a3000) ioctl$MON_IOCT_RING_SIZE(r4, 0x9204, 0xfda86) r5 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r6, r7, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x0, @fd_index=0x5, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB], 0x48) io_uring_enter(r5, 0x26c3, 0xdffffffb, 0x4c, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf259900000008000300", @ANYRES32=r2], 0x1c}}, 0x40084) msgsnd(0x0, &(0x7f00000001c0)=ANY=[], 0x401, 0x0) msgsnd(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x8, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1000}, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) r9 = msgget(0x1, 0x80) msgrcv(r9, &(0x7f0000000240)={0x0, ""/29}, 0x25, 0x1, 0x800) msgrcv(0x0, &(0x7f00000002c0), 0x8, 0x0, 0x800) syz_usb_connect(0x0, 0x57, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000036b40f202104a000e1c80000000109024500010000000009040000020202ff00052406000105240000000d240f010000000000f2ff000006241a000000042402"], 0x0) msgsnd(0x0, &(0x7f0000000080)={0x0, "d8fee98e8459f17334e7a081f676e4f6c9e0cc2454bdfffabc12c66e9661bff95c341eb3af4e5942dce82e3be0b56ed6f4f9cebcd00fa28d09da22de59cbaf5fe80a3055994e6ba6f68ba6923ccc7c86540c71034ae3bae349e0b051523320d233ce96c8e92313a2100ce3b51825ea056dee9d5e98ec8d129a1c8f136103d17f46f47cee8aeb5622db7a48e9967ad67605762d31451f55221df7bcef854396e617da40eb28600d532d524b4242887ca93f581507af98273dd47a52f0be909fb17945a5d2f339656f2da1f35002322941e2e89f12010e0b5b11b1"}, 0xe2, 0x0) 1.213333269s ago: executing program 3 (id=336): add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000080)="0000000000000002ff69fe0000000001000000c000000002000200861fa72e5b01504104bfeacdd5a9007d167c71e3b8a93aa64d957a684161c833020a6da8881fb79e110483bfadf224a22c76ecc7a56843a85f7df51293f0eb84ef8f0f07342db3b0e5a5647b7bed1fbf069ca713670adf7d9fb6d2600fd9c1981fe9f095cfe9d2fe1e1e34f6096bf02543747b2c792890f07c0da0fa25e6101062e6c9176a70e41698814a213711764f88495994cfd8a57c1e13f6b5298e7ab3a2bfb58dde34d58536633c27882e51ced17d67999b00094461", 0xd4, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000080000000000000004850000006d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x49, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r3 = getpgid(0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_G_OUTPUT(r5, 0x8004562e, &(0x7f0000000000)) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0000006c00190c00000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="9e84050000000000180034"], 0x4c}, 0x1, 0x0, 0x0, 0x8}, 0x40040) r6 = syz_pidfd_open(r3, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r6, 0xff04, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r2}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha3-512-generic\x00'}}) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x10, 0x5, 0x0, 0xa, 0x0, 0x70bd28, 0x25dfdbfb, [@sadb_x_policy={0x8, 0x12, 0x2, 0x3, 0x0, 0x6e6bb7, 0x100, {0x6, 0x3c, 0x0, 0x9, 0x0, 0xfffffffa, 0x0, @in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x50}}, 0x4000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}}, 0x0) 72.654859ms ago: executing program 5 (id=337): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553f288a00"/16, 0x10) r1 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) pwrite64(r1, &(0x7f00000008c0)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0) lseek(r1, 0x0, 0x4) sendfile(r1, r1, &(0x7f00000001c0), 0x7fa) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') rename(&(0x7f0000000240)='./file2\x00', &(0x7f0000000280)='./file0/file0\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xa6) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)=ANY=[@ANYBLOB='usrqardlimit=p,\x00'/28]) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r2) r3 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x20004050}, 0x0) r4 = io_uring_setup(0x1037, &(0x7f0000000200)={0x0, 0xf842, 0x2000, 0x1, 0x1e}) syz_io_uring_setup(0x876, &(0x7f0000000280)={0x0, 0x6e3a, 0x800, 0xfffffffd, 0x197, 0x0, r4}, &(0x7f0000000100), &(0x7f0000000440)) r5 = syz_open_dev$tty1(0xc, 0x4, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB], &(0x7f0000000300)='syzkaller\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) ioctl$TCSETSF2(r5, 0x402c542d, &(0x7f00000000c0)={0xff, 0x6, 0xa, 0x3, 0x11, "5dc6046f01aad0002c35e7347d09a1dd45214c", 0x0, 0x9}) write$binfmt_script(r3, &(0x7f0000000600), 0xfec8) syz_clone3(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) 0s ago: executing program 3 (id=338): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0x52000775) open(&(0x7f00000000c0)='.\x00', 0x800, 0x50) r4 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000be5000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r4, 0x838a3000) ioctl$MON_IOCT_RING_SIZE(r4, 0x9204, 0xfda86) r5 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r6, r7, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x0, @fd_index=0x5, 0x0, 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) io_uring_enter(r5, 0x26c3, 0xdffffffb, 0x4c, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf259900000008000300", @ANYRES32=r2], 0x1c}}, 0x40084) msgsnd(0x0, &(0x7f00000001c0)=ANY=[], 0x401, 0x0) msgsnd(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x8, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1000}, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) r9 = msgget(0x1, 0x80) msgrcv(r9, &(0x7f0000000240)={0x0, ""/29}, 0x25, 0x1, 0x800) msgrcv(0x0, &(0x7f00000002c0), 0x8, 0x0, 0x800) syz_usb_connect(0x0, 0x57, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000036b40f202104a000e1c80000000109024500010000000009040000020202ff00052406000105240000000d240f010000000000f2ff000006241a000000042402"], 0x0) msgsnd(0x0, &(0x7f0000000080)={0x0, "d8fee98e8459f17334e7a081f676e4f6c9e0cc2454bdfffabc12c66e9661bff95c341eb3af4e5942dce82e3be0b56ed6f4f9cebcd00fa28d09da22de59cbaf5fe80a3055994e6ba6f68ba6923ccc7c86540c71034ae3bae349e0b051523320d233ce96c8e92313a2100ce3b51825ea056dee9d5e98ec8d129a1c8f136103d17f46f47cee8aeb5622db7a48e9967ad67605762d31451f55221df7bcef854396e617da40eb28600d532d524b4242887ca93f581507af98273dd47a52f0be909fb17945a5d2f339656f2da1f35002322941e2e89f12010e0b5b11b1"}, 0xe2, 0x0) kernel console output (not intermixed with test programs): 680809][ T5801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.686100][ T5803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.765149][ T5805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.767255][ T5800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.824991][ T5801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.092244][ T5117] Bluetooth: hci2: command tx timeout [ 88.133853][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.133865][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.133877][ T5802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.182278][ T5117] Bluetooth: hci3: command tx timeout [ 88.182297][ T5808] Bluetooth: hci4: command tx timeout [ 88.182309][ T5117] Bluetooth: hci0: command tx timeout [ 88.252053][ T61] Bluetooth: hci1: command tx timeout [ 88.294800][ T5803] team0: Port device team_slave_0 added [ 88.363546][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.363561][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.363581][ T5802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.366322][ T5805] team0: Port device team_slave_0 added [ 88.368433][ T5800] team0: Port device team_slave_0 added [ 88.370448][ T5803] team0: Port device team_slave_1 added [ 88.385430][ T5801] team0: Port device team_slave_0 added [ 88.388178][ T5805] team0: Port device team_slave_1 added [ 88.393085][ T5800] team0: Port device team_slave_1 added [ 88.466677][ T5801] team0: Port device team_slave_1 added [ 89.403426][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.403441][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.403455][ T5803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.483727][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.483743][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.483764][ T5805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.485106][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.485118][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.485139][ T5800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.580392][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.580406][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.580429][ T5803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.581452][ T5801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.581460][ T5801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.581472][ T5801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.585716][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.585729][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.585752][ T5805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.587222][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.587233][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.587254][ T5800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.598668][ T5802] hsr_slave_0: entered promiscuous mode [ 89.600577][ T5802] hsr_slave_1: entered promiscuous mode [ 89.638207][ T5801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.638222][ T5801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.638244][ T5801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.172140][ T61] Bluetooth: hci2: command tx timeout [ 90.261927][ T61] Bluetooth: hci4: command tx timeout [ 90.261960][ T61] Bluetooth: hci0: command tx timeout [ 90.261977][ T61] Bluetooth: hci3: command tx timeout [ 90.304178][ T5803] hsr_slave_0: entered promiscuous mode [ 90.305588][ T5803] hsr_slave_1: entered promiscuous mode [ 90.306612][ T5803] debugfs: 'hsr0' already exists in 'hsr' [ 90.306727][ T5803] Cannot create hsr debugfs directory [ 90.332341][ T5808] Bluetooth: hci1: command tx timeout [ 90.477830][ T5805] hsr_slave_0: entered promiscuous mode [ 90.478667][ T5805] hsr_slave_1: entered promiscuous mode [ 90.479223][ T5805] debugfs: 'hsr0' already exists in 'hsr' [ 90.479244][ T5805] Cannot create hsr debugfs directory [ 90.487111][ T5800] hsr_slave_0: entered promiscuous mode [ 90.488458][ T5800] hsr_slave_1: entered promiscuous mode [ 90.490079][ T5800] debugfs: 'hsr0' already exists in 'hsr' [ 90.490101][ T5800] Cannot create hsr debugfs directory [ 90.600103][ T5801] hsr_slave_0: entered promiscuous mode [ 90.601463][ T5801] hsr_slave_1: entered promiscuous mode [ 90.613788][ T5801] debugfs: 'hsr0' already exists in 'hsr' [ 90.613805][ T5801] Cannot create hsr debugfs directory [ 92.092875][ T5802] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.131188][ T5802] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.146600][ T5802] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.204963][ T5802] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.262593][ T5808] Bluetooth: hci2: command tx timeout [ 92.324906][ T5805] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.332219][ T61] Bluetooth: hci0: command tx timeout [ 92.332249][ T61] Bluetooth: hci4: command tx timeout [ 92.332298][ T5808] Bluetooth: hci3: command tx timeout [ 92.376282][ T5805] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.411032][ T5805] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.413615][ T5808] Bluetooth: hci1: command tx timeout [ 92.448679][ T5805] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.575525][ T5803] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.619816][ T5803] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.661413][ T5803] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.712583][ T5803] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.845970][ T5800] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.882982][ T5800] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.920258][ T5800] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.952343][ T5800] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.039516][ T5802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.097159][ T5801] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.133882][ T5801] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.170256][ T5801] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 93.212752][ T5801] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 93.254878][ T5802] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.289979][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.290864][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.326107][ T5805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.336790][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.336981][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.409805][ T5805] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.444114][ T1335] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.444234][ T1335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.493282][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.493424][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.499018][ T5803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.601480][ T5800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.605506][ T5803] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.655330][ T1335] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.655531][ T1335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.699697][ T1335] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.699864][ T1335] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.725011][ T5800] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.760991][ T5801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.799910][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.800409][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.867475][ T1446] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.867617][ T1446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.944800][ T5801] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.984339][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.984560][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.027918][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.028078][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.098974][ T5802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.245696][ T5805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.357012][ T5802] veth0_vlan: entered promiscuous mode [ 94.418772][ T5802] veth1_vlan: entered promiscuous mode [ 94.563809][ T5805] veth0_vlan: entered promiscuous mode [ 94.618762][ T5803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.619548][ T5805] veth1_vlan: entered promiscuous mode [ 94.651827][ T5802] veth0_macvtap: entered promiscuous mode [ 94.674749][ T5802] veth1_macvtap: entered promiscuous mode [ 94.683249][ T5800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.747389][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.751716][ T5801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.780433][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.787768][ T5805] veth0_macvtap: entered promiscuous mode [ 94.838023][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.853060][ T5805] veth1_macvtap: entered promiscuous mode [ 94.858042][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.868325][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.882133][ T1335] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.906769][ T5803] veth0_vlan: entered promiscuous mode [ 95.044772][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.046943][ T5800] veth0_vlan: entered promiscuous mode [ 95.069275][ T5803] veth1_vlan: entered promiscuous mode [ 95.096777][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.177869][ T5800] veth1_vlan: entered promiscuous mode [ 95.188132][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.196318][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.200991][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.210651][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.311714][ T1446] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.311736][ T1446] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.492625][ T5803] veth0_macvtap: entered promiscuous mode [ 95.517694][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.517710][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.554859][ T5803] veth1_macvtap: entered promiscuous mode [ 95.604587][ T5800] veth0_macvtap: entered promiscuous mode [ 95.608841][ T3573] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.608860][ T3573] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.615591][ T5801] veth0_vlan: entered promiscuous mode [ 95.645441][ T5800] veth1_macvtap: entered promiscuous mode [ 95.683970][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.687086][ T5801] veth1_vlan: entered promiscuous mode [ 95.734332][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.736853][ T3573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.736870][ T3573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.752866][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.791009][ T70] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.791227][ T70] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.791262][ T70] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.791293][ T70] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.840166][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.897807][ T43] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.901757][ T43] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.954255][ T43] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.977146][ T43] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.369222][ T5801] veth0_macvtap: entered promiscuous mode [ 99.390072][ T5931] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6'. [ 99.390280][ T5931] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 99.390291][ T5931] IPv6: NLM_F_CREATE should be set when creating new route [ 99.390730][ T5931] IPv6: NLM_F_CREATE should be set when creating new route [ 99.393500][ T31] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 99.480603][ T5933] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 99.563146][ T31] usb 4-1: config 0 has no interfaces? [ 99.563181][ T31] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 99.563202][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.581680][ T5801] veth1_macvtap: entered promiscuous mode [ 99.587400][ T31] usb 4-1: config 0 descriptor?? [ 99.755093][ T3573] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.755112][ T3573] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.825380][ T5801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.871937][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.881932][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.885929][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.887001][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.888066][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.889125][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.890186][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.891242][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.891881][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 99.892304][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 100.222078][ T5791] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 100.227743][ T5801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.248654][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.248672][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.287945][ T1335] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.287964][ T1335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.294788][ T1446] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.316602][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.319387][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.320803][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.377733][ T5791] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 100.377750][ T5791] usb 1-1: config 0 has no interface number 0 [ 100.377883][ T5791] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 100.377896][ T5791] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 100.383325][ T5791] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 100.383350][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 100.383367][ T5791] usb 1-1: Product: syz [ 100.383380][ T5791] usb 1-1: SerialNumber: syz [ 100.418169][ T5791] usb 1-1: config 0 descriptor?? [ 100.492932][ T5791] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 100.519371][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.519395][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.519610][ T5791] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input5 [ 100.853272][ T5934] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 101.419387][ T5894] usb 4-1: USB disconnect, device number 2 [ 102.272151][ T5791] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 102.718832][ T5791] usb 2-1: Using ep0 maxpacket: 32 [ 103.160652][ T5791] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 103.160677][ T5791] usb 2-1: config 0 has no interface number 0 [ 103.185539][ T5791] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 103.185567][ T5791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.185636][ T5791] usb 2-1: Product: syz [ 103.185650][ T5791] usb 2-1: Manufacturer: syz [ 103.185662][ T5791] usb 2-1: SerialNumber: syz [ 103.282546][ T5791] usb 2-1: config 0 descriptor?? [ 103.317331][ T5791] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 103.497065][ T1446] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.497085][ T1446] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.650417][ T5941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2'. [ 103.698940][ T5791] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 103.973140][ T5791] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 105.302106][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.305599][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.306174][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.307866][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.308102][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.308328][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.308552][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.308780][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.309018][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.309250][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.476807][ T5809] usb 1-1: USB disconnect, device number 2 [ 105.476958][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 105.524705][ T9] IPVS: starting estimator thread 0... [ 105.591810][ T5937] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.592130][ T5937] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.619788][ T5955] IPVS: using max 14 ests per chain, 33600 per kthread [ 105.743552][ T5879] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 105.756550][ T5809] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 105.923161][ T5879] usb 3-1: Using ep0 maxpacket: 32 [ 105.932611][ T5879] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.932640][ T5879] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.932676][ T5879] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 105.932696][ T5879] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.556127][ T5879] usb 3-1: config 0 descriptor?? [ 117.559193][ T5879] usb 3-1: can't set config #0, error -71 [ 117.565844][ T5879] usb 3-1: USB disconnect, device number 2 [ 118.036849][ T5989] netlink: 48 bytes leftover after parsing attributes in process `syz.2.13'. [ 118.409109][ T5990] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 119.122017][ T5991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15'. [ 119.176612][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 119.325395][ T5879] usb 2-1: USB disconnect, device number 2 [ 119.423484][ T5879] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 119.504434][ T5879] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 119.505435][ T5879] quatech2 2-1:0.51: device disconnected [ 119.710399][ T6003] netlink: 48 bytes leftover after parsing attributes in process `syz.0.17'. [ 120.964122][ T6007] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 121.257966][ T5808] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 121.273476][ T5808] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 121.274460][ T5808] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 121.275669][ T5808] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 121.276442][ T5808] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 121.361677][ T6016] netlink: 48 bytes leftover after parsing attributes in process `syz.0.19'. [ 122.157292][ T6017] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 122.229407][ T6022] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 122.553544][ T6001] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 122.892200][ T6027] netlink: 44 bytes leftover after parsing attributes in process `syz.0.20'. [ 122.995566][ T6026] overlayfs: overlapping lowerdir path [ 123.292877][ T5808] Bluetooth: hci5: command tx timeout [ 124.018420][ T6037] tmpfs: Unknown parameter 'usrqardlimit' [ 124.913589][ T6039] trusted_key: syz.0.23 sent an empty control message without MSG_MORE. [ 125.373001][ T5808] Bluetooth: hci5: command tx timeout [ 125.572002][ T9] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 125.724413][ T9] usb 4-1: config 0 has no interfaces? [ 125.724448][ T9] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 125.724468][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.806957][ T9] usb 4-1: config 0 descriptor?? [ 127.313107][ T31] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 127.644331][ T5808] Bluetooth: hci5: command tx timeout [ 128.174853][ T31] usb 5-1: config 0 has no interfaces? [ 128.174887][ T31] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 128.174908][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.218019][ T31] usb 5-1: config 0 descriptor?? [ 128.373056][ T31] usb 4-1: USB disconnect, device number 3 [ 128.583928][ T6056] netlink: 48 bytes leftover after parsing attributes in process `syz.3.29'. [ 128.652014][ T5791] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 128.812186][ T5791] usb 3-1: Using ep0 maxpacket: 32 [ 128.816296][ T5791] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 128.816351][ T5791] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 128.816390][ T5791] usb 3-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 128.816410][ T5791] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.842567][ T5791] usb 3-1: config 0 descriptor?? [ 129.491099][ T6059] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 129.655417][ T44] usb 5-1: USB disconnect, device number 2 [ 129.692964][ T5808] Bluetooth: hci5: command tx timeout [ 129.779492][ T6064] Zero length message leads to an empty skb [ 129.796335][ T5791] usb 3-1: bad CDC descriptors [ 129.845459][ T5791] usb 3-1: USB disconnect, device number 3 [ 131.308330][ T5968] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.191930][ T5809] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 132.350528][ T5809] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 132.350556][ T5809] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.350573][ T5809] usb 4-1: Product: syz [ 132.350585][ T5809] usb 4-1: Manufacturer: syz [ 132.350597][ T5809] usb 4-1: SerialNumber: syz [ 132.363394][ T5809] usb 4-1: config 0 descriptor?? [ 132.572765][ T5968] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.615132][ T6072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.34'. [ 132.621515][ T5791] usb 4-1: USB disconnect, device number 4 [ 132.899487][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.899624][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.937414][ T5968] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.712008][ T5809] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 134.879865][ T5809] usb 5-1: unable to get BOS descriptor or descriptor too short [ 134.890871][ T5809] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 134.890897][ T5809] usb 5-1: config 160 has no interface number 0 [ 134.890932][ T5809] usb 5-1: config 160 interface 186 has no altsetting 0 [ 134.918525][ T5809] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 134.918552][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.918570][ T5809] usb 5-1: Product: syz [ 134.918582][ T5809] usb 5-1: Manufacturer: syz [ 134.918595][ T5809] usb 5-1: SerialNumber: syz [ 135.034812][ T5968] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.223643][ T5809] qmi_wwan 5-1:160.186: probe with driver qmi_wwan failed with error -22 [ 135.252958][ T5809] usb 5-1: USB disconnect, device number 3 [ 135.774925][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 136.046297][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 136.206413][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 136.207066][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 136.410939][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 136.410966][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.410983][ T9] usb 1-1: Product: syz [ 136.410996][ T9] usb 1-1: Manufacturer: syz [ 136.411007][ T9] usb 1-1: SerialNumber: syz [ 136.455088][ T5809] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 136.607817][ T5809] usb 3-1: config 0 has no interfaces? [ 136.607853][ T5809] usb 3-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 136.607873][ T5809] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.685216][ T9] usb 1-1: 0:2 : does not exist [ 136.695393][ T5809] usb 3-1: config 0 descriptor?? [ 136.713817][ T9] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 136.814968][ T5999] chnl_net:caif_netlink_parms(): no params data found [ 136.934647][ T6101] netlink: 16 bytes leftover after parsing attributes in process `syz.3.42'. [ 137.584880][ T9] usb 1-1: USB disconnect, device number 3 [ 139.035244][ T990] usb 3-1: USB disconnect, device number 4 [ 139.199983][ T5859] udevd[5859]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 139.395720][ T6119] netlink: 48 bytes leftover after parsing attributes in process `syz.4.46'. [ 139.511369][ T9] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 139.571986][ T5880] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 139.695528][ T9] usb 1-1: config 0 has no interfaces? [ 139.695559][ T9] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 139.695605][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.698605][ T9] usb 1-1: config 0 descriptor?? [ 139.762843][ T5880] usb 3-1: Using ep0 maxpacket: 32 [ 139.868164][ T6127] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 140.537106][ T5880] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 140.537159][ T5880] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 140.537198][ T5880] usb 3-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 140.537218][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.611467][ T5880] usb 3-1: config 0 descriptor?? [ 140.629569][ T5880] usb 3-1: bad CDC descriptors [ 140.858788][ T5880] usb 3-1: USB disconnect, device number 5 [ 141.535270][ T5968] bridge_slave_1: left allmulticast mode [ 141.535382][ T5968] bridge_slave_1: left promiscuous mode [ 141.539437][ T5968] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.774028][ T990] usb 1-1: USB disconnect, device number 4 [ 141.893929][ T5968] bridge_slave_0: left allmulticast mode [ 141.893955][ T5968] bridge_slave_0: left promiscuous mode [ 141.894597][ T5968] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.937502][ T6139] netlink: 48 bytes leftover after parsing attributes in process `syz.3.50'. [ 143.301250][ T6143] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 147.919551][ T6154] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 149.158042][ T6163] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 149.512842][ T5887] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 149.701969][ T5887] usb 1-1: Using ep0 maxpacket: 32 [ 149.704619][ T5887] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 149.704676][ T5887] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 149.704716][ T5887] usb 1-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 149.704736][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.710933][ T5887] usb 1-1: config 0 descriptor?? [ 150.556910][ T5887] usb 1-1: bad CDC descriptors [ 150.622051][ T5978] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 150.682898][ T6175] netlink: 48 bytes leftover after parsing attributes in process `syz.4.61'. [ 151.106046][ T6180] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 151.569454][ T5978] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 151.569481][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.569499][ T5978] usb 4-1: Product: syz [ 151.569511][ T5978] usb 4-1: Manufacturer: syz [ 151.569523][ T5978] usb 4-1: SerialNumber: syz [ 151.594638][ T5978] usb 4-1: config 0 descriptor?? [ 151.813039][ T5978] usb 4-1: USB disconnect, device number 5 [ 151.833474][ T6182] process 'syz.4.63' launched '/dev/fd/5' with NULL argv: empty string added [ 151.901968][ T5791] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 152.056662][ T5791] usb 3-1: unable to get BOS descriptor or descriptor too short [ 152.057983][ T5791] usb 3-1: config 160 has an invalid interface number: 186 but max is 0 [ 152.058005][ T5791] usb 3-1: config 160 has no interface number 0 [ 152.058035][ T5791] usb 3-1: config 160 interface 186 has no altsetting 0 [ 152.060522][ T5791] usb 3-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 152.060546][ T5791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.060563][ T5791] usb 3-1: Product: syz [ 152.060575][ T5791] usb 3-1: Manufacturer: syz [ 152.060587][ T5791] usb 3-1: SerialNumber: syz [ 152.321390][ T5791] qmi_wwan 3-1:160.186: probe with driver qmi_wwan failed with error -22 [ 152.335975][ T5791] usb 3-1: USB disconnect, device number 6 [ 152.462047][ T5978] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 153.522701][ T5978] usb 5-1: Using ep0 maxpacket: 32 [ 153.525792][ T5978] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.525859][ T5978] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 153.525905][ T5978] usb 5-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 153.525935][ T5978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.580358][ T5978] usb 5-1: config 0 descriptor?? [ 153.589667][ T5978] usb 5-1: bad CDC descriptors [ 153.768202][ T6198] netlink: 64 bytes leftover after parsing attributes in process `syz.3.68'. [ 154.105743][ T6202] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 156.265803][ T5968] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 156.322514][ T5968] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 156.344524][ T5968] bond0 (unregistering): Released all slaves [ 156.490293][ T5999] bridge0: port 1(bridge_slave_0) entered blocking state [ 156.490410][ T5999] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.490585][ T5999] bridge_slave_0: entered allmulticast mode [ 156.523562][ T5999] bridge_slave_0: entered promiscuous mode [ 156.617688][ T5879] usb 1-1: USB disconnect, device number 5 [ 156.676411][ T5887] usb 5-1: USB disconnect, device number 4 [ 156.705810][ T5999] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.705952][ T5999] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.706167][ T5999] bridge_slave_1: entered allmulticast mode [ 156.708815][ T5999] bridge_slave_1: entered promiscuous mode [ 157.951578][ T6227] netlink: 44 bytes leftover after parsing attributes in process `syz.2.74'. [ 158.002814][ T6224] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 158.212049][ T44] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 160.522340][ T44] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 160.522368][ T44] usb 4-1: config 0 has no interface number 0 [ 160.522409][ T44] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 160.522432][ T44] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 160.525480][ T44] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 160.525506][ T44] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 160.525524][ T44] usb 4-1: Product: syz [ 160.525536][ T44] usb 4-1: SerialNumber: syz [ 160.691317][ T44] usb 4-1: config 0 descriptor?? [ 160.929728][ T6240] netlink: 64 bytes leftover after parsing attributes in process `syz.2.79'. [ 161.354716][ T6244] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 162.018146][ T44] usb 4-1: can't set config #0, error -71 [ 162.020613][ T44] usb 4-1: USB disconnect, device number 6 [ 162.294051][ T5887] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 162.477611][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 162.535447][ T5935] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 162.752246][ T5935] usb 1-1: Using ep0 maxpacket: 32 [ 163.233890][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.233920][ T5887] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 163.233958][ T5887] usb 3-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 163.233977][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.292204][ T5887] usb 3-1: config 0 descriptor?? [ 163.314444][ T5935] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.314473][ T5935] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 163.314509][ T5935] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 163.314528][ T5935] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.374087][ T5935] usb 1-1: config 0 descriptor?? [ 163.388697][ T5935] hub 1-1:0.0: USB hub found [ 163.417232][ T5999] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 163.442287][ T990] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 163.695576][ T5935] hub 1-1:0.0: 1 port detected [ 163.757711][ T6248] netlink: 24 bytes leftover after parsing attributes in process `syz.2.82'. [ 164.616677][ T6257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.617239][ T6257] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.760011][ T990] usb 5-1: config 0 has no interfaces? [ 164.760048][ T990] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 164.760067][ T990] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.785993][ T990] usb 5-1: config 0 descriptor?? [ 164.860266][ T5887] thrustmaster 0003:044F:B654.0001: hidraw0: USB HID v0.00 Device [HID 044f:b654] on usb-dummy_hcd.2-1/input0 [ 164.860308][ T5887] thrustmaster 0003:044F:B654.0001: no inputs found [ 164.920455][ T6259] capability: warning: `syz.2.82' uses 32-bit capabilities (legacy support in use) [ 164.981734][ T5935] hub 1-1:0.0: activate --> -90 [ 165.186622][ T5935] hub 1-1:0.0: hub_ext_port_status failed (err = -71) [ 165.190776][ T5935] usb 1-1: USB disconnect, device number 6 [ 165.191163][ T990] usb 1-1: Failed to suspend device, error -19 [ 165.486789][ T6266] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 166.104164][ T5999] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 166.305356][ T44] usb 5-1: USB disconnect, device number 5 [ 166.629231][ T6275] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 167.955399][ T5880] usb 3-1: USB disconnect, device number 7 [ 167.990335][ T6287] netlink: 64 bytes leftover after parsing attributes in process `syz.0.92'. [ 168.221975][ T44] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 168.499939][ T6292] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 168.786154][ T6295] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 169.422214][ T44] usb 5-1: Using ep0 maxpacket: 16 [ 169.442234][ T44] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 169.442265][ T44] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 169.442301][ T44] usb 5-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 169.442320][ T44] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.499878][ T44] usb 5-1: config 0 descriptor?? [ 169.505624][ T5999] team0: Port device team_slave_0 added [ 169.551091][ T5999] team0: Port device team_slave_1 added [ 171.708083][ T44] usbhid 5-1:0.0: can't add hid device: -71 [ 171.708274][ T44] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 171.712805][ T44] usb 5-1: USB disconnect, device number 6 [ 171.717575][ T5968] hsr_slave_0: left promiscuous mode [ 171.786883][ T5968] hsr_slave_1: left promiscuous mode [ 171.787960][ T5968] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 171.788070][ T5968] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 171.844176][ T5968] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 171.844204][ T5968] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 171.950823][ T5968] veth1_macvtap: left promiscuous mode [ 171.951015][ T5968] veth0_macvtap: left promiscuous mode [ 171.952580][ T5968] veth1_vlan: left promiscuous mode [ 171.952870][ T5968] veth0_vlan: left promiscuous mode [ 172.162000][ T44] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 172.252604][ T5879] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 172.331381][ T44] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 172.331402][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.331411][ T44] usb 5-1: Product: syz [ 172.331418][ T44] usb 5-1: Manufacturer: syz [ 172.331424][ T44] usb 5-1: SerialNumber: syz [ 172.370262][ T44] usb 5-1: config 0 descriptor?? [ 172.407967][ T5879] usb 4-1: Using ep0 maxpacket: 32 [ 172.424453][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.424484][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.424519][ T5879] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 172.424539][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.431785][ T5879] usb 4-1: config 0 descriptor?? [ 172.510192][ T5879] hub 4-1:0.0: USB hub found [ 172.647947][ T44] usb 5-1: USB disconnect, device number 7 [ 172.692776][ T5879] hub 4-1:0.0: 1 port detected [ 173.488068][ T5879] hub 4-1:0.0: activate --> -90 [ 173.860054][ T5879] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 173.872481][ T5879] usb 4-1: USB disconnect, device number 7 [ 174.262538][ T5968] team0 (unregistering): Port device team_slave_1 removed [ 175.792570][ T5968] team0 (unregistering): Port device team_slave_0 removed [ 175.900681][ T6328] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 176.327054][ T6329] netlink: 36 bytes leftover after parsing attributes in process `syz.4.104'. [ 177.661973][ T5935] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 177.816497][ T5935] usb 4-1: Using ep0 maxpacket: 32 [ 177.818943][ T5935] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.818994][ T5935] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 177.819022][ T5935] usb 4-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 177.819033][ T5935] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.868163][ T5935] usb 4-1: config 0 descriptor?? [ 177.871311][ T5935] usb 4-1: bad CDC descriptors [ 178.780783][ T5117] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 178.799062][ T5117] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 178.799984][ T5117] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 178.801046][ T5117] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 178.801739][ T5117] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 179.016331][ T6306] netlink: 44 bytes leftover after parsing attributes in process `syz.2.97'. [ 179.052001][ T44] usb 4-1: USB disconnect, device number 8 [ 179.212220][ T6353] tmpfs: Unknown parameter 'usrqardlimit' [ 180.792688][ T6360] netlink: 48 bytes leftover after parsing attributes in process `syz.0.111'. [ 180.893117][ T5808] Bluetooth: hci3: command tx timeout [ 181.160029][ T6369] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 181.986411][ T6368] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 182.377350][ T6377] tmpfs: Unknown parameter 'usrqardlimit' [ 182.401952][ T990] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 182.562645][ T990] usb 5-1: Using ep0 maxpacket: 32 [ 182.945938][ T990] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 182.945993][ T990] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 182.946028][ T990] usb 5-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 182.946046][ T990] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.005239][ T5808] Bluetooth: hci3: command tx timeout [ 183.412086][ T990] usb 5-1: config 0 descriptor?? [ 183.447316][ T990] usb 5-1: bad CDC descriptors [ 183.631475][ T5935] usb 5-1: USB disconnect, device number 8 [ 183.901483][ T6393] netlink: 64 bytes leftover after parsing attributes in process `syz.0.118'. [ 184.307850][ T6403] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 184.824486][ T6402] netlink: 48 bytes leftover after parsing attributes in process `syz.3.120'. [ 185.117953][ T5808] Bluetooth: hci3: command tx timeout [ 185.254389][ T6407] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 186.080623][ T6415] netlink: 48 bytes leftover after parsing attributes in process `syz.3.124'. [ 186.383830][ T990] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 187.265904][ T5808] Bluetooth: hci3: command tx timeout [ 187.362062][ T990] usb 1-1: Using ep0 maxpacket: 32 [ 187.364518][ T990] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.364546][ T990] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.364579][ T990] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 187.364599][ T990] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.473855][ T990] usb 1-1: config 0 descriptor?? [ 187.519956][ T990] hub 1-1:0.0: USB hub found [ 187.625547][ T6433] netlink: 64 bytes leftover after parsing attributes in process `syz.3.125'. [ 187.721684][ T6434] overlayfs: overlapping lowerdir path [ 187.937142][ T990] hub 1-1:0.0: 1 port detected [ 187.965072][ T6345] chnl_net:caif_netlink_parms(): no params data found [ 188.089301][ T6441] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 188.160573][ T6442] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 188.692365][ T990] hub 1-1:0.0: activate --> -90 [ 188.880850][ T6451] netlink: 64 bytes leftover after parsing attributes in process `syz.4.130'. [ 188.913654][ T5894] hub 1-1:0.0: hub_ext_port_status failed (err = -71) [ 188.914853][ T5894] usb 1-1: USB disconnect, device number 7 [ 188.915569][ T5935] usb 1-1: Failed to suspend device, error -19 [ 189.232865][ T6458] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 189.961952][ T990] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 190.327684][ T6468] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 191.062029][ T990] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 191.062054][ T990] usb 3-1: config 0 has no interface number 0 [ 191.062100][ T990] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 191.062122][ T990] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 191.081927][ T5978] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 191.115711][ T990] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 191.115738][ T990] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 191.115755][ T990] usb 3-1: Product: syz [ 191.115768][ T990] usb 3-1: SerialNumber: syz [ 191.235862][ T6474] netlink: 48 bytes leftover after parsing attributes in process `syz.3.135'. [ 191.236468][ T990] usb 3-1: config 0 descriptor?? [ 191.387499][ T990] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 191.390831][ T990] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input6 [ 191.405918][ T5978] usb 5-1: unable to get BOS descriptor or descriptor too short [ 191.407347][ T5978] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 191.407368][ T5978] usb 5-1: config 160 has no interface number 0 [ 191.407454][ T5978] usb 5-1: config 160 interface 186 has no altsetting 0 [ 191.410727][ T5978] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 191.410762][ T5978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.410779][ T5978] usb 5-1: Product: syz [ 191.410791][ T5978] usb 5-1: Manufacturer: syz [ 191.410804][ T5978] usb 5-1: SerialNumber: syz [ 192.497507][ T5879] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 192.497798][ C0] raw-gadget.2 gadget.0: ignoring, device is not running [ 192.621968][ T5879] usb 1-1: device descriptor read/64, error -32 [ 192.812179][ T5978] qmi_wwan 5-1:160.186: probe with driver qmi_wwan failed with error -22 [ 192.893351][ T5879] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 192.898802][ T5968] IPVS: stop unused estimator thread 0... [ 192.937974][ T5978] usb 5-1: USB disconnect, device number 9 [ 193.041985][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 193.044705][ T5879] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.044784][ T5879] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 193.044814][ T5879] usb 1-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 193.044883][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.280329][ T5879] usb 1-1: config 0 descriptor?? [ 193.303430][ T5879] usb 1-1: bad CDC descriptors [ 193.467007][ T6345] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.467375][ T6345] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.492673][ T6345] bridge_slave_0: entered allmulticast mode [ 193.516379][ T6345] bridge_slave_0: entered promiscuous mode [ 193.600162][ T6345] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.600238][ T6345] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.623713][ T6345] bridge_slave_1: entered allmulticast mode [ 193.746579][ T6345] bridge_slave_1: entered promiscuous mode [ 193.753303][ T5791] usb 1-1: USB disconnect, device number 9 [ 195.107786][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.107859][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.314746][ T5809] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 195.503324][ T5968] bridge_slave_1: left allmulticast mode [ 195.503401][ T5968] bridge_slave_1: left promiscuous mode [ 195.503755][ T5968] bridge0: port 2(bridge_slave_1) entered disabled state [ 195.508968][ T5809] usb 4-1: unable to get BOS descriptor or descriptor too short [ 195.544325][ T5809] usb 4-1: config 160 has an invalid interface number: 186 but max is 0 [ 195.544351][ T5809] usb 4-1: config 160 has no interface number 0 [ 195.544383][ T5809] usb 4-1: config 160 interface 186 has no altsetting 0 [ 195.587903][ T5809] usb 4-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 195.587932][ T5809] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.587949][ T5809] usb 4-1: Product: syz [ 195.587961][ T5809] usb 4-1: Manufacturer: syz [ 195.587973][ T5809] usb 4-1: SerialNumber: syz [ 195.650339][ T5968] bridge_slave_0: left allmulticast mode [ 195.650368][ T5968] bridge_slave_0: left promiscuous mode [ 195.729913][ T5968] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.879790][ T5809] qmi_wwan 4-1:160.186: probe with driver qmi_wwan failed with error -22 [ 195.928719][ T5809] usb 4-1: USB disconnect, device number 9 [ 195.967303][ T5859] udevd[5859]: setting owner of /dev/bus/usb/004/009 to uid=0, gid=0 failed: No such file or directory [ 196.261099][ T5968] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 196.468113][ T5968] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 196.554601][ T5968] bond0 (unregistering): Released all slaves [ 197.138186][ T6503] netlink: 8 bytes leftover after parsing attributes in process `syz.3.140'. [ 197.138311][ T6503] netlink: 8 bytes leftover after parsing attributes in process `syz.3.140'. [ 198.008822][ T6507] netlink: 48 bytes leftover after parsing attributes in process `syz.3.142'. [ 198.389231][ T6510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 199.175235][ T6514] netlink: 36 bytes leftover after parsing attributes in process `syz.3.143'. [ 199.186491][ T6345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.302773][ C1] cm109_urb_ctl_callback: 641 callbacks suppressed [ 199.302800][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.303039][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.303337][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.303573][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.303807][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.304048][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.304283][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.304518][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.304758][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.305292][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 199.305407][ T5935] usb 3-1: USB disconnect, device number 8 [ 199.305530][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 199.548963][ T5935] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 199.877637][ T6520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.144'. [ 199.877705][ T6520] netlink: 20 bytes leftover after parsing attributes in process `syz.4.144'. [ 200.594039][ T5968] team0 (unregistering): Port device team_slave_1 removed [ 201.032388][ T5968] team0 (unregistering): Port device team_slave_0 removed [ 201.311999][ T5879] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 201.414100][ T6345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 201.471934][ T5879] usb 4-1: Using ep0 maxpacket: 32 [ 201.474464][ T5879] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 201.474515][ T5879] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 201.474551][ T5879] usb 4-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 201.474569][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.509965][ T5879] usb 4-1: config 0 descriptor?? [ 201.537312][ T5879] usb 4-1: bad CDC descriptors [ 201.728864][ T5880] usb 4-1: USB disconnect, device number 10 [ 203.061953][ T5879] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 203.139807][ T6345] team0: Port device team_slave_0 added [ 203.151763][ T6345] team0: Port device team_slave_1 added [ 203.172038][ T44] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 203.221875][ T5879] usb 5-1: Using ep0 maxpacket: 32 [ 203.224675][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 203.224703][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 203.224739][ T5879] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 203.224759][ T5879] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.235392][ T6538] tmpfs: Unknown parameter 'usrqardlimit' [ 203.282883][ T5879] usb 5-1: config 0 descriptor?? [ 203.312865][ T5879] hub 5-1:0.0: USB hub found [ 203.344026][ T44] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 203.344054][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.344071][ T44] usb 1-1: Product: syz [ 203.344083][ T44] usb 1-1: Manufacturer: syz [ 203.344095][ T44] usb 1-1: SerialNumber: syz [ 203.410700][ T44] usb 1-1: config 0 descriptor?? [ 203.462021][ T5880] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 203.534538][ T5879] hub 5-1:0.0: 1 port detected [ 203.613594][ T5880] usb 4-1: Using ep0 maxpacket: 16 [ 203.627268][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 203.627296][ T5880] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 203.627390][ T5880] usb 4-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 203.627410][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.680316][ T44] usb 1-1: USB disconnect, device number 10 [ 203.680912][ T6345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 203.680923][ T6345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 203.680945][ T6345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 203.791032][ T6345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 203.791047][ T6345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 203.791070][ T6345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.922479][ T5880] usb 4-1: config 0 descriptor?? [ 204.056239][ T5866] udevd[5866]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 204.158864][ T6545] netlink: 36 bytes leftover after parsing attributes in process `syz.2.154'. [ 204.159480][ T5879] hub 5-1:0.0: activate --> -90 [ 204.390924][ T5935] usb 5-1: USB disconnect, device number 10 [ 204.405259][ T6345] hsr_slave_0: entered promiscuous mode [ 204.407613][ T6535] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.408178][ T6535] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.415357][ T6345] hsr_slave_1: entered promiscuous mode [ 204.416318][ T6345] debugfs: 'hsr0' already exists in 'hsr' [ 204.416341][ T6345] Cannot create hsr debugfs directory [ 204.487809][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487846][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487871][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487895][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487919][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487943][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487967][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.487990][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.488023][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.488047][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: unknown main item tag 0x0 [ 204.610816][ T44] hid-generic 0007:FFFFFFF8:0FFF.0002: hidraw0: HID v0.07 Device [syz1] on syz0 [ 204.659986][ T5879] hub 5-1:0.0: hub_ext_port_status failed (err = -71) [ 204.823995][ T6552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.155'. [ 204.824070][ T6552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.155'. [ 205.380043][ T6543] netlink: 24 bytes leftover after parsing attributes in process `syz.0.153'. [ 205.472537][ T5880] thrustmaster 0003:044F:B654.0003: hidraw1: USB HID v0.00 Device [HID 044f:b654] on usb-dummy_hcd.3-1/input0 [ 205.472566][ T5880] thrustmaster 0003:044F:B654.0003: no inputs found [ 205.728947][ T6562] netlink: 64 bytes leftover after parsing attributes in process `syz.4.156'. [ 206.148793][ T6569] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 206.751958][ T5812] Bluetooth: hci1: command 0x0406 tx timeout [ 206.857222][ T5812] Bluetooth: hci2: command 0x0406 tx timeout [ 206.857490][ T5812] Bluetooth: hci4: command 0x0406 tx timeout [ 206.857515][ T5812] Bluetooth: hci0: command 0x0406 tx timeout [ 207.057092][ T5880] usb 4-1: USB disconnect, device number 11 [ 207.194936][ T6579] Bluetooth: MGMT ver 1.23 [ 207.738031][ T6584] overlayfs: failed to resolve './file1/file0': -2 [ 210.361995][ T44] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 210.514079][ T44] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 210.514103][ T44] usb 5-1: config 0 has no interface number 0 [ 210.514147][ T44] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 210.514169][ T44] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 210.577842][ T44] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 210.577870][ T44] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 210.577888][ T44] usb 5-1: Product: syz [ 210.577900][ T44] usb 5-1: SerialNumber: syz [ 210.623181][ T6345] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 210.648880][ T44] usb 5-1: config 0 descriptor?? [ 210.690409][ T5915] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 210.710719][ T6345] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 210.725010][ T44] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 210.759972][ T44] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input7 [ 210.864453][ T5915] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 210.864479][ T5915] usb 3-1: config 0 has no interface number 0 [ 210.864585][ T5915] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 210.864609][ T5915] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 210.867256][ T5915] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 210.867281][ T5915] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 210.867299][ T5915] usb 3-1: Product: syz [ 210.867311][ T5915] usb 3-1: SerialNumber: syz [ 211.186866][ T6617] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.659540][ T6345] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 211.720930][ T5915] usb 3-1: config 0 descriptor?? [ 211.735228][ T6345] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 211.957097][ T5915] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 212.049760][ T6620] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 212.605905][ T5915] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input8 [ 213.628939][ C1] cm109_urb_ctl_callback: 1 callbacks suppressed [ 213.628965][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.629210][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.629466][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.629710][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.629956][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.631279][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.631537][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.632847][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.633094][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.634180][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 213.727600][ T5978] usb 5-1: USB disconnect, device number 11 [ 213.727691][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 213.946049][ T5978] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 214.037879][ T5879] usb 3-1: USB disconnect, device number 9 [ 214.038067][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 214.060538][ T6345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 214.140221][ T5879] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 214.151554][ T6345] 8021q: adding VLAN 0 to HW filter on device team0 [ 214.206479][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.206627][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 214.346402][ T5937] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.346544][ T5937] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.424760][ T6345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 217.691197][ T6345] veth0_vlan: entered promiscuous mode [ 217.701925][ T5879] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 217.945823][ T6345] veth1_vlan: entered promiscuous mode [ 218.074765][ T6676] netlink: 8 bytes leftover after parsing attributes in process `syz.0.174'. [ 218.118022][ T5894] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 218.804598][ T5879] usb 5-1: Using ep0 maxpacket: 32 [ 218.819629][ T5879] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 218.819686][ T5879] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 218.819726][ T5879] usb 5-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 218.819745][ T5879] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.881533][ T5879] usb 5-1: config 0 descriptor?? [ 218.900164][ T5879] usb 5-1: bad CDC descriptors [ 218.900810][ T6345] veth0_macvtap: entered promiscuous mode [ 218.937832][ T6345] veth1_macvtap: entered promiscuous mode [ 218.942890][ T5894] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 218.942914][ T5894] usb 3-1: config 0 has no interface number 0 [ 218.942958][ T5894] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 218.942981][ T5894] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 218.945236][ T5894] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 218.945260][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 218.945276][ T5894] usb 3-1: Product: syz [ 218.945288][ T5894] usb 3-1: SerialNumber: syz [ 218.986716][ T5894] usb 3-1: config 0 descriptor?? [ 219.009231][ T5894] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 219.052132][ T5894] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input9 [ 219.106180][ T5978] usb 5-1: USB disconnect, device number 12 [ 219.127235][ T6345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 219.165087][ T6345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 219.202871][ T5968] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.203482][ T5968] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.204661][ T5968] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.204704][ T5968] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.489637][ T6680] tmpfs: Unknown parameter 'usrqardlimit' [ 219.520994][ T6672] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.939234][ T6684] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 220.473419][ T5974] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 220.473438][ T5974] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 220.578870][ T6688] netlink: 48 bytes leftover after parsing attributes in process `syz.3.178'. [ 220.878761][ T6692] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 221.851455][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 221.851467][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.005439][ C1] cm109_urb_ctl_callback: 616 callbacks suppressed [ 222.005463][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.006555][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.006807][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.007070][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.007320][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.007574][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.007805][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.008048][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.008322][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.008616][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 222.010800][ T5978] usb 3-1: USB disconnect, device number 10 [ 222.010834][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 222.178409][ T5978] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 222.303317][ T6701] veth1_macvtap: left promiscuous mode [ 222.303342][ T6701] macsec0: entered allmulticast mode [ 222.375761][ T6703] veth1_macvtap: entered promiscuous mode [ 222.375783][ T6703] veth1_macvtap: entered allmulticast mode [ 222.375841][ T6703] macsec0: left allmulticast mode [ 222.375852][ T6703] veth1_macvtap: left allmulticast mode [ 222.426594][ T6701] binder: 6700:6701 ioctl c0306201 0 returned -14 [ 223.802751][ T6714] tmpfs: Unknown parameter 'usrqardlimit' [ 224.031301][ T6720] netlink: 56 bytes leftover after parsing attributes in process `syz.5.185'. [ 224.368589][ T6722] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 225.507994][ T6724] overlayfs: failed to resolve './file1/file0': -2 [ 225.795599][ T6727] netlink: 56 bytes leftover after parsing attributes in process `syz.5.186'. [ 225.801268][ T6730] netlink: 48 bytes leftover after parsing attributes in process `syz.3.188'. [ 226.770605][ T6739] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 227.199830][ T6747] netlink: 36 bytes leftover after parsing attributes in process `syz.2.191'. [ 228.231907][ T5915] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 228.291963][ T5791] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 228.409896][ T5915] usb 3-1: unable to get BOS descriptor or descriptor too short [ 228.411644][ T5915] usb 3-1: config 160 has an invalid interface number: 186 but max is 0 [ 228.411667][ T5915] usb 3-1: config 160 has no interface number 0 [ 228.411698][ T5915] usb 3-1: config 160 interface 186 has no altsetting 0 [ 228.422221][ T5915] usb 3-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 228.422247][ T5915] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.422264][ T5915] usb 3-1: Product: syz [ 228.422276][ T5915] usb 3-1: Manufacturer: syz [ 228.422288][ T5915] usb 3-1: SerialNumber: syz [ 228.502069][ T5791] usb 5-1: Using ep0 maxpacket: 32 [ 228.508820][ T5791] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 228.508873][ T5791] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 228.508963][ T5791] usb 5-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 228.508983][ T5791] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.828418][ T5791] usb 5-1: config 0 descriptor?? [ 228.866827][ T5791] usb 5-1: bad CDC descriptors [ 228.870966][ T5915] qmi_wwan 3-1:160.186: probe with driver qmi_wwan failed with error -22 [ 228.973615][ T5915] usb 3-1: USB disconnect, device number 11 [ 229.663382][ T5915] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 229.988619][ T5915] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 229.988644][ T5915] usb 6-1: config 0 has no interface number 0 [ 229.988672][ T5915] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 229.988685][ T5915] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 229.991406][ T5915] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 229.991422][ T5915] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 229.991432][ T5915] usb 6-1: Product: syz [ 229.991438][ T5915] usb 6-1: SerialNumber: syz [ 230.005074][ T5915] usb 6-1: config 0 descriptor?? [ 230.106418][ T5915] cm109 6-1:0.8: invalid payload size 0, expected 4 [ 230.141584][ T5915] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input10 [ 230.295915][ T6799] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.150066][ T5978] usb 5-1: USB disconnect, device number 13 [ 231.491062][ C1] cm109_urb_ctl_callback: 6 callbacks suppressed [ 231.491092][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.491335][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.491585][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.493519][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.493789][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.494019][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.494245][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.494467][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.494689][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.494911][ C1] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 231.545774][ T5915] usb 6-1: USB disconnect, device number 2 [ 231.545862][ C1] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 231.753715][ T6812] netlink: 48 bytes leftover after parsing attributes in process `syz.4.201'. [ 231.907617][ T6812] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 231.946763][ T5915] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 232.426794][ T6818] netlink: 48 bytes leftover after parsing attributes in process `syz.4.202'. [ 232.729791][ T6820] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 233.834198][ T6824] netlink: 36 bytes leftover after parsing attributes in process `syz.3.203'. [ 234.349418][ T6836] tmpfs: Unknown parameter 'usrqardlimit' [ 235.179905][ T6840] netlink: 48 bytes leftover after parsing attributes in process `syz.4.207'. [ 235.396923][ T6841] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 238.598433][ T5879] IPVS: starting estimator thread 0... [ 238.643418][ T6863] netlink: 83 bytes leftover after parsing attributes in process `syz.3.209'. [ 238.704566][ T6864] IPVS: using max 10 ests per chain, 24000 per kthread [ 239.202139][ T5809] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 239.209461][ T6868] netlink: 16 bytes leftover after parsing attributes in process `syz.2.212'. [ 239.215684][ T5978] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 239.351914][ T5809] usb 1-1: Using ep0 maxpacket: 32 [ 239.353810][ T5809] usb 1-1: config 0 has an invalid interface number: 111 but max is 1 [ 239.353832][ T5809] usb 1-1: config 0 has no interface number 1 [ 239.359770][ T5809] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 239.359796][ T5809] usb 1-1: New USB device strings: Mfr=33, Product=2, SerialNumber=3 [ 239.359813][ T5809] usb 1-1: Product: syz [ 239.359826][ T5809] usb 1-1: Manufacturer: syz [ 239.359838][ T5809] usb 1-1: SerialNumber: syz [ 239.383804][ T5978] usb 5-1: config 0 has no interfaces? [ 239.383837][ T5978] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 239.383857][ T5978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.400820][ T5809] usb 1-1: config 0 descriptor?? [ 239.423316][ T5978] usb 5-1: config 0 descriptor?? [ 239.469295][ T6875] tmpfs: Unknown parameter 'usrqardlimit' [ 239.659974][ T5808] Bluetooth: hci1: unexpected event for opcode 0x2012 [ 239.776120][ T5978] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 240.010757][ T5978] usb 3-1: unable to get BOS descriptor or descriptor too short [ 240.020795][ T5978] usb 3-1: config 160 has an invalid interface number: 186 but max is 0 [ 240.020819][ T5978] usb 3-1: config 160 has no interface number 0 [ 240.020852][ T5978] usb 3-1: config 160 interface 186 has no altsetting 0 [ 240.028699][ T5978] usb 3-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 240.028773][ T5978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.028791][ T5978] usb 3-1: Product: syz [ 240.028803][ T5978] usb 3-1: Manufacturer: syz [ 240.028815][ T5978] usb 3-1: SerialNumber: syz [ 240.485642][ T5978] qmi_wwan 3-1:160.186: probe with driver qmi_wwan failed with error -22 [ 240.493695][ T5809] snd-usb-6fire 1-1:0.111: unable to receive device firmware state. [ 240.493741][ T5809] snd-usb-6fire 1-1:0.111: probe with driver snd-usb-6fire failed with error -110 [ 240.545487][ T5978] usb 3-1: USB disconnect, device number 12 [ 240.772310][ T5880] usb 5-1: USB disconnect, device number 14 [ 240.830951][ T5809] usb 1-1: USB disconnect, device number 11 [ 240.943707][ T6885] sctp: [Deprecated]: syz.4.215 (pid 6885) Use of struct sctp_assoc_value in delayed_ack socket option. [ 240.943707][ T6885] Use struct sctp_sack_info instead [ 241.024191][ T6886] netlink: 36 bytes leftover after parsing attributes in process `syz.5.216'. [ 242.804408][ T6897] netlink: 48 bytes leftover after parsing attributes in process `syz.5.221'. [ 243.005098][ T5978] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 243.065375][ T6900] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 243.132241][ T5809] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 243.155164][ T5978] usb 4-1: config 0 has no interfaces? [ 243.155200][ T5978] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 243.155221][ T5978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.161392][ T5978] usb 4-1: config 0 descriptor?? [ 243.371332][ T5808] Bluetooth: hci4: unexpected event for opcode 0x2012 [ 243.401967][ T5809] usb 1-1: Using ep0 maxpacket: 8 [ 243.404321][ T5809] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.413133][ T5809] usb 1-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 243.413157][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.413174][ T5809] usb 1-1: Product: syz [ 243.413186][ T5809] usb 1-1: Manufacturer: syz [ 243.413197][ T5809] usb 1-1: SerialNumber: syz [ 243.841272][ T5809] usb 1-1: config 0 descriptor?? [ 244.187623][ T5809] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 244.187840][ T5809] usb 1-1: selecting invalid altsetting 1 [ 244.218505][ T6908] tmpfs: Unknown parameter 'usrqardlimit' [ 244.794885][ T31] usb 4-1: USB disconnect, device number 12 [ 244.910814][ T5809] gspca_stk014: reg_r err -110 [ 244.910921][ T5809] stk014 1-1:0.0: probe with driver stk014 failed with error -110 [ 244.981085][ T5894] usb 1-1: USB disconnect, device number 12 [ 245.514006][ T6919] tmpfs: Unknown parameter 'usrqardlimit' [ 247.078444][ T6930] netlink: 4 bytes leftover after parsing attributes in process `syz.2.229'. [ 247.155469][ T6930] gretap0: entered promiscuous mode [ 247.155658][ T6930] macsec1: entered promiscuous mode [ 247.155965][ T6930] macsec1: entered allmulticast mode [ 247.155978][ T6930] gretap0: entered allmulticast mode [ 247.212770][ T6930] gretap0: left allmulticast mode [ 247.213051][ T6930] gretap0: left promiscuous mode [ 247.268379][ T6940] netlink: 48 bytes leftover after parsing attributes in process `syz.4.233'. [ 247.361947][ T5978] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 247.561299][ T6942] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 248.408523][ T5978] usb 1-1: Using ep0 maxpacket: 32 [ 248.434137][ T5978] usb 1-1: unable to get BOS descriptor or descriptor too short [ 248.435540][ T5978] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 248.438834][ T5978] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 248.438858][ T5978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.438875][ T5978] usb 1-1: Product: syz [ 248.438887][ T5978] usb 1-1: Manufacturer: syz [ 248.438900][ T5978] usb 1-1: SerialNumber: syz [ 248.741548][ T6936] netlink: 'syz.3.231': attribute type 5 has an invalid length. [ 248.946789][ T5978] usb 1-1: Limiting number of CPorts to U8_MAX [ 248.950786][ T5978] usb 1-1: Not enough endpoints found in device, aborting! [ 249.077887][ T6957] FAULT_INJECTION: forcing a failure. [ 249.077887][ T6957] name failslab, interval 1, probability 0, space 0, times 1 [ 249.077933][ T6957] CPU: 1 UID: 0 PID: 6957 Comm: syz.3.237 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 249.077953][ T6957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 249.077971][ T6957] Call Trace: [ 249.077981][ T6957] [ 249.077989][ T6957] dump_stack_lvl+0x189/0x250 [ 249.078024][ T6957] ? __pfx____ratelimit+0x10/0x10 [ 249.078046][ T6957] ? __pfx_dump_stack_lvl+0x10/0x10 [ 249.078069][ T6957] ? __pfx__printk+0x10/0x10 [ 249.078098][ T6957] ? __lock_acquire+0xab9/0xd20 [ 249.078126][ T6957] should_fail_ex+0x46c/0x600 [ 249.078153][ T6957] ? skb_clone+0x212/0x3a0 [ 249.078171][ T6957] should_failslab+0xa8/0x100 [ 249.078195][ T6957] ? skb_clone+0x212/0x3a0 [ 249.078212][ T6957] kmem_cache_alloc_noprof+0x6f/0x6b0 [ 249.078242][ T6957] skb_clone+0x212/0x3a0 [ 249.078264][ T6957] __netlink_deliver_tap+0x404/0x850 [ 249.078295][ T6957] ? netlink_deliver_tap+0x2e/0x1b0 [ 249.078329][ T6957] netlink_deliver_tap+0x19c/0x1b0 [ 249.078348][ T6957] netlink_unicast+0x811/0xa10 [ 249.078381][ T6957] ? __pfx_netlink_unicast+0x10/0x10 [ 249.078405][ T6957] ? netlink_sendmsg+0x642/0xb30 [ 249.078420][ T6957] ? skb_put+0x11b/0x210 [ 249.078441][ T6957] netlink_sendmsg+0x805/0xb30 [ 249.078468][ T6957] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.078493][ T6957] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 249.078514][ T6957] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.078530][ T6957] __sock_sendmsg+0x21c/0x270 [ 249.078551][ T6957] ____sys_sendmsg+0x508/0x820 [ 249.078575][ T6957] ? __pfx_____sys_sendmsg+0x10/0x10 [ 249.078604][ T6957] ? import_iovec+0x74/0xa0 [ 249.078626][ T6957] ___sys_sendmsg+0x21f/0x2a0 [ 249.078646][ T6957] ? __pfx____sys_sendmsg+0x10/0x10 [ 249.078703][ T6957] ? __fget_files+0x2a/0x420 [ 249.078724][ T6957] ? __fget_files+0x3a6/0x420 [ 249.078764][ T6957] __x64_sys_sendmsg+0x1a1/0x260 [ 249.078786][ T6957] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 249.078817][ T6957] ? __pfx_ksys_write+0x10/0x10 [ 249.078840][ T6957] ? do_syscall_64+0xbe/0xfa0 [ 249.078862][ T6957] do_syscall_64+0xfa/0xfa0 [ 249.078878][ T6957] ? lockdep_hardirqs_on+0x9c/0x150 [ 249.078897][ T6957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.078914][ T6957] ? clear_bhb_loop+0x60/0xb0 [ 249.078933][ T6957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.078948][ T6957] RIP: 0033:0x7fe41aafefc9 [ 249.078969][ T6957] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 249.078982][ T6957] RSP: 002b:00007fe418d5e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 249.079007][ T6957] RAX: ffffffffffffffda RBX: 00007fe41ad55fa0 RCX: 00007fe41aafefc9 [ 249.079020][ T6957] RDX: 0000000000000040 RSI: 0000200000000140 RDI: 0000000000000003 [ 249.079031][ T6957] RBP: 00007fe418d5e090 R08: 0000000000000000 R09: 0000000000000000 [ 249.079041][ T6957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 249.079051][ T6957] R13: 00007fe41ad56038 R14: 00007fe41ad55fa0 R15: 00007ffda1540dd8 [ 249.079082][ T6957] [ 249.080116][ T6957] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 249.198734][ T6958] tmpfs: Unknown parameter 'usrqardlimit' [ 249.284315][ T5879] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 249.883540][ T5879] usb 3-1: Using ep0 maxpacket: 8 [ 250.008011][ T5879] usb 3-1: config 0 has an invalid interface number: 96 but max is 0 [ 250.008036][ T5879] usb 3-1: config 0 has no interface number 0 [ 250.008086][ T5879] usb 3-1: config 0 interface 96 altsetting 3 endpoint 0x88 has an invalid bInterval 254, changing to 11 [ 250.008111][ T5879] usb 3-1: config 0 interface 96 has no altsetting 0 [ 250.023210][ T5879] usb 3-1: New USB device found, idVendor=0b57, idProduct=2a8d, bcdDevice=33.74 [ 250.023245][ T5879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.023262][ T5879] usb 3-1: Product: syz [ 250.023274][ T5879] usb 3-1: Manufacturer: syz [ 250.023286][ T5879] usb 3-1: SerialNumber: syz [ 250.064646][ T5879] usb 3-1: config 0 descriptor?? [ 250.235756][ T6971] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 250.235771][ T6971] IPv6: NLM_F_CREATE should be set when creating new route [ 250.235824][ T6971] IPv6: NLM_F_CREATE should be set when creating new route [ 250.235854][ T6971] IPv6: NLM_F_CREATE should be set when creating new route [ 250.265998][ T5978] usb 1-1: USB disconnect, device number 13 [ 250.283027][ T6971] netlink: 40 bytes leftover after parsing attributes in process `syz.4.241'. [ 250.355780][ T6954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.376416][ T6954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.395946][ T6954] netlink: 'syz.2.236': attribute type 10 has an invalid length. [ 250.479645][ T6954] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 250.522482][ T5879] usb 3-1: USB disconnect, device number 13 [ 251.138813][ T6981] netlink: 48 bytes leftover after parsing attributes in process `syz.5.245'. [ 251.409479][ T6984] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 252.479849][ T6986] netlink: 'syz.5.248': attribute type 5 has an invalid length. [ 252.512701][ T6992] netlink: 48 bytes leftover after parsing attributes in process `syz.3.247'. [ 253.906682][ T6995] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 254.352924][ T7008] tmpfs: Unknown parameter 'usrqardlimit' [ 254.367969][ T7007] veth0: entered promiscuous mode [ 254.771681][ T7004] veth0: left promiscuous mode [ 254.831954][ T5978] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 254.989822][ T5978] usb 1-1: config 1 interface 0 has no altsetting 0 [ 255.001158][ T5978] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 255.001185][ T5978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.001202][ T5978] usb 1-1: Product: syz [ 255.001214][ T5978] usb 1-1: Manufacturer: syz [ 255.001227][ T5978] usb 1-1: SerialNumber: syz [ 256.342504][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.342574][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.363641][ T5978] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 14 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 256.367327][ T7024] syz.5.255 (7024) used greatest stack depth: 18360 bytes left [ 256.558466][ T7028] netlink: 48 bytes leftover after parsing attributes in process `syz.2.258'. [ 256.852033][ T5879] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 257.149036][ T7035] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 258.658362][ T7039] netlink: 'syz.2.261': attribute type 5 has an invalid length. [ 258.681929][ T5879] usb 5-1: device not accepting address 15, error -71 [ 259.918739][ T9] usb 1-1: USB disconnect, device number 14 [ 259.947925][ T9] usblp0: removed [ 260.003530][ T5809] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 260.172937][ T5809] usb 3-1: Using ep0 maxpacket: 8 [ 260.178380][ T5809] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 260.178406][ T5809] usb 3-1: config 0 has an invalid interface descriptor of length 7, skipping [ 260.178421][ T5809] usb 3-1: config 0 has no interface number 0 [ 260.178474][ T5809] usb 3-1: config 0 interface 186 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 260.182494][ T5809] usb 3-1: New USB device found, idVendor=07c0, idProduct=1500, bcdDevice=b8.c5 [ 260.182519][ T5809] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.182536][ T5809] usb 3-1: Product: syz [ 260.182548][ T5809] usb 3-1: Manufacturer: syz [ 260.182560][ T5809] usb 3-1: SerialNumber: syz [ 260.204053][ T5809] usb 3-1: config 0 descriptor?? [ 260.226495][ T5809] iowarrior 3-1:0.186: no interrupt-in endpoint found [ 260.471988][ T5978] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 260.595623][ T7066] FAULT_INJECTION: forcing a failure. [ 260.595623][ T7066] name failslab, interval 1, probability 0, space 0, times 0 [ 260.595688][ T7066] CPU: 1 UID: 0 PID: 7066 Comm: syz.2.265 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 260.595709][ T7066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 260.595719][ T7066] Call Trace: [ 260.595726][ T7066] [ 260.595734][ T7066] dump_stack_lvl+0x189/0x250 [ 260.595762][ T7066] ? __pfx____ratelimit+0x10/0x10 [ 260.595783][ T7066] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.595806][ T7066] ? __pfx__printk+0x10/0x10 [ 260.595832][ T7066] ? __pfx___might_resched+0x10/0x10 [ 260.595855][ T7066] should_fail_ex+0x46c/0x600 [ 260.595887][ T7066] should_failslab+0xa8/0x100 [ 260.595912][ T7066] __kmalloc_noprof+0xcc/0x7d0 [ 260.595933][ T7066] ? kfree+0x51/0x950 [ 260.595949][ T7066] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 260.595975][ T7066] tomoyo_realpath_from_path+0xe3/0x5d0 [ 260.595996][ T7066] ? tomoyo_domain+0xda/0x130 [ 260.596021][ T7066] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 260.596045][ T7066] tomoyo_path_number_perm+0x1e8/0x5a0 [ 260.596072][ T7066] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 260.596100][ T7066] ? __pfx___schedule+0x10/0x10 [ 260.596117][ T7066] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 260.596171][ T7066] ? __fget_files+0x2a/0x420 [ 260.596197][ T7066] ? __fget_files+0x3a6/0x420 [ 260.596224][ T7066] ? __fget_files+0x2a/0x420 [ 260.596250][ T7066] security_file_ioctl+0xcb/0x2d0 [ 260.596270][ T7066] __se_sys_ioctl+0x47/0x170 [ 260.596293][ T7066] do_syscall_64+0xfa/0xfa0 [ 260.596314][ T7066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.596331][ T7066] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 260.596347][ T7066] ? clear_bhb_loop+0x60/0xb0 [ 260.596367][ T7066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.596384][ T7066] RIP: 0033:0x7f996eb4efc9 [ 260.596399][ T7066] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 260.596413][ T7066] RSP: 002b:00007f996cd95038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 260.596432][ T7066] RAX: ffffffffffffffda RBX: 00007f996eda6090 RCX: 00007f996eb4efc9 [ 260.596445][ T7066] RDX: 0000200000000080 RSI: 00000000c00c642d RDI: 0000000000000006 [ 260.596463][ T7066] RBP: 00007f996cd95090 R08: 0000000000000000 R09: 0000000000000000 [ 260.596474][ T7066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.596484][ T7066] R13: 00007f996eda6128 R14: 00007f996eda6090 R15: 00007fff9b32ade8 [ 260.596515][ T7066] [ 260.596551][ T7066] ERROR: Out of memory at tomoyo_realpath_from_path. [ 260.705701][ T7068] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.709254][ T7068] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.842297][ T5791] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 261.043542][ T5791] usb 1-1: Using ep0 maxpacket: 32 [ 261.127490][ T5791] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.127905][ T5791] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 261.127976][ T5791] usb 1-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 261.127996][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.280219][ T5791] usb 1-1: config 0 descriptor?? [ 261.421343][ T5791] usb 1-1: bad CDC descriptors [ 261.897881][ T5791] usb 1-1: USB disconnect, device number 15 [ 262.136525][ T5978] usb 4-1: Using ep0 maxpacket: 16 [ 262.287828][ T5978] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.287859][ T5978] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 262.300235][ T5978] usb 4-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 262.300262][ T5978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.958681][ T5791] usb 3-1: USB disconnect, device number 14 [ 264.591155][ T5978] usb 4-1: config 0 descriptor?? [ 264.591725][ T5978] usb 4-1: can't set config #0, error -71 [ 264.615824][ T5978] usb 4-1: USB disconnect, device number 13 [ 264.619720][ T5866] udevd[5866]: setting owner of /dev/bus/usb/004/013 to uid=0, gid=0 failed: No such file or directory [ 264.697542][ T7070] netlink: 48 bytes leftover after parsing attributes in process `syz.3.269'. [ 264.896419][ C1] vkms_vblank_simulate: vblank timer overrun [ 265.030869][ T7076] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 265.073263][ C1] vkms_vblank_simulate: vblank timer overrun [ 265.353668][ C1] vkms_vblank_simulate: vblank timer overrun [ 265.556931][ C1] vkms_vblank_simulate: vblank timer overrun [ 265.851587][ T7084] FAULT_INJECTION: forcing a failure. [ 265.851587][ T7084] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 265.851665][ T7084] CPU: 0 UID: 0 PID: 7084 Comm: syz.4.275 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 265.851682][ T7084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 265.851690][ T7084] Call Trace: [ 265.851695][ T7084] [ 265.851702][ T7084] dump_stack_lvl+0x189/0x250 [ 265.851725][ T7084] ? __pfx____ratelimit+0x10/0x10 [ 265.851741][ T7084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 265.851763][ T7084] ? __pfx__printk+0x10/0x10 [ 265.851779][ T7084] ? __might_fault+0xb0/0x130 [ 265.851808][ T7084] should_fail_ex+0x46c/0x600 [ 265.851831][ T7084] _copy_from_user+0x2d/0xb0 [ 265.851847][ T7084] video_usercopy+0x346/0x1450 [ 265.851870][ T7084] ? smk_tskacc+0x2fc/0x370 [ 265.851890][ T7084] ? __pfx___video_do_ioctl+0x10/0x10 [ 265.851907][ T7084] ? __pfx_video_usercopy+0x10/0x10 [ 265.851922][ T7084] ? smack_file_ioctl+0x2ac/0x340 [ 265.851957][ T7084] ? __fget_files+0x3a6/0x420 [ 265.851980][ T7084] v4l2_ioctl+0x190/0x1e0 [ 265.851997][ T7084] ? __pfx_v4l2_ioctl+0x10/0x10 [ 265.852014][ T7084] __se_sys_ioctl+0xff/0x170 [ 265.852033][ T7084] do_syscall_64+0xfa/0xfa0 [ 265.852051][ T7084] ? lockdep_hardirqs_on+0x9c/0x150 [ 265.852067][ T7084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.852082][ T7084] ? clear_bhb_loop+0x60/0xb0 [ 265.852100][ T7084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.852115][ T7084] RIP: 0033:0x7f90a4daefc9 [ 265.852130][ T7084] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 265.852142][ T7084] RSP: 002b:00007f90a3016038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 265.852160][ T7084] RAX: ffffffffffffffda RBX: 00007f90a5005fa0 RCX: 00007f90a4daefc9 [ 265.852171][ T7084] RDX: 0000200000000040 RSI: 00000000c0845657 RDI: 0000000000000003 [ 265.852181][ T7084] RBP: 00007f90a3016090 R08: 0000000000000000 R09: 0000000000000000 [ 265.852191][ T7084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 265.852200][ T7084] R13: 00007f90a5006038 R14: 00007f90a5005fa0 R15: 00007ffe959b2808 [ 265.852227][ T7084] [ 265.871926][ T990] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 266.021963][ T990] usb 3-1: Using ep0 maxpacket: 32 [ 266.025442][ T990] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 266.025486][ T990] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 266.025505][ T990] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.040749][ T990] usb 3-1: config 0 descriptor?? [ 266.067986][ T990] hub 3-1:0.0: bad descriptor, ignoring hub [ 266.068024][ T990] hub 3-1:0.0: probe with driver hub failed with error -5 [ 266.089630][ T990] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 266.181897][ T5894] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 266.331960][ T5894] usb 6-1: Using ep0 maxpacket: 32 [ 266.335155][ T5894] usb 6-1: unable to get BOS descriptor or descriptor too short [ 266.337232][ T5894] usb 6-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 266.527299][ C1] vkms_vblank_simulate: vblank timer overrun [ 266.530454][ T5894] usb 6-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 266.530480][ T5894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.530495][ T5894] usb 6-1: Product: syz [ 266.530507][ T5894] usb 6-1: Manufacturer: syz [ 266.530518][ T5894] usb 6-1: SerialNumber: syz [ 266.829367][ T5894] usb 6-1: Limiting number of CPorts to U8_MAX [ 266.830678][ T5894] usb 6-1: Not enough endpoints found in device, aborting! [ 266.862312][ T7101] overlayfs: failed to resolve './file0/file0': -2 [ 266.862644][ T5809] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 267.031862][ T5809] usb 4-1: Using ep0 maxpacket: 16 [ 267.034421][ T5809] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 267.034448][ T5809] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 267.034483][ T5809] usb 4-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 267.034502][ T5809] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.039920][ T5809] usb 4-1: config 0 descriptor?? [ 267.285880][ T7109] FAULT_INJECTION: forcing a failure. [ 267.285880][ T7109] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 267.285966][ T7109] CPU: 0 UID: 0 PID: 7109 Comm: syz.0.282 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 267.285985][ T7109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 267.285994][ T7109] Call Trace: [ 267.286001][ T7109] [ 267.286008][ T7109] dump_stack_lvl+0x189/0x250 [ 267.286037][ T7109] ? __pfx____ratelimit+0x10/0x10 [ 267.286057][ T7109] ? __pfx_dump_stack_lvl+0x10/0x10 [ 267.286082][ T7109] ? __pfx__printk+0x10/0x10 [ 267.286101][ T7109] ? __might_fault+0xb0/0x130 [ 267.286130][ T7109] should_fail_ex+0x46c/0x600 [ 267.286154][ T7109] _copy_from_iter+0x1de/0x1790 [ 267.286183][ T7109] ? kmalloc_reserve+0xbd/0x290 [ 267.286198][ T7109] ? rcu_is_watching+0x15/0xb0 [ 267.286216][ T7109] ? kmalloc_reserve+0xbd/0x290 [ 267.286229][ T7109] ? __alloc_skb+0x112/0x2d0 [ 267.286245][ T7109] ? __pfx__copy_from_iter+0x10/0x10 [ 267.286270][ T7109] ? __build_skb_around+0x262/0x3f0 [ 267.286288][ T7109] ? netlink_sendmsg+0x642/0xb30 [ 267.286303][ T7109] ? skb_put+0x11b/0x210 [ 267.286321][ T7109] netlink_sendmsg+0x6b2/0xb30 [ 267.286337][ T7109] ? is_bpf_text_address+0x26/0x2b0 [ 267.286367][ T7109] ? __pfx_netlink_sendmsg+0x10/0x10 [ 267.286395][ T7109] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 267.286413][ T7109] ? __pfx_netlink_sendmsg+0x10/0x10 [ 267.286426][ T7109] __sock_sendmsg+0x21c/0x270 [ 267.286447][ T7109] ____sys_sendmsg+0x508/0x820 [ 267.286466][ T7109] ? __pfx_____sys_sendmsg+0x10/0x10 [ 267.286488][ T7109] ? import_iovec+0x74/0xa0 [ 267.286505][ T7109] ___sys_sendmsg+0x21f/0x2a0 [ 267.286522][ T7109] ? __pfx____sys_sendmsg+0x10/0x10 [ 267.286565][ T7109] ? __fget_files+0x2a/0x420 [ 267.286582][ T7109] ? __fget_files+0x3a6/0x420 [ 267.286610][ T7109] __x64_sys_sendmsg+0x1a1/0x260 [ 267.286631][ T7109] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 267.286658][ T7109] ? __pfx_ksys_write+0x10/0x10 [ 267.286678][ T7109] ? do_syscall_64+0xbe/0xfa0 [ 267.286701][ T7109] do_syscall_64+0xfa/0xfa0 [ 267.286716][ T7109] ? lockdep_hardirqs_on+0x9c/0x150 [ 267.286733][ T7109] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.286749][ T7109] ? clear_bhb_loop+0x60/0xb0 [ 267.286765][ T7109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.286779][ T7109] RIP: 0033:0x7fa917eeefc9 [ 267.286793][ T7109] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 267.286806][ T7109] RSP: 002b:00007fa91614e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 267.286824][ T7109] RAX: ffffffffffffffda RBX: 00007fa918145fa0 RCX: 00007fa917eeefc9 [ 267.286834][ T7109] RDX: 0000000000040014 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 267.286845][ T7109] RBP: 00007fa91614e090 R08: 0000000000000000 R09: 0000000000000000 [ 267.286855][ T7109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 267.286865][ T7109] R13: 00007fa918146038 R14: 00007fa918145fa0 R15: 00007ffdec098c08 [ 267.286887][ T7109] [ 267.306489][ T7086] serio: Serial port pty31 [ 267.529506][ T7098] netlink: 24 bytes leftover after parsing attributes in process `syz.3.279'. [ 267.535987][ T7098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.536749][ T7098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.599607][ T5894] usb 6-1: USB disconnect, device number 3 [ 267.674508][ T5809] thrustmaster 0003:044F:B654.0004: hidraw0: USB HID v0.00 Device [HID 044f:b654] on usb-dummy_hcd.3-1/input0 [ 267.674538][ T5809] thrustmaster 0003:044F:B654.0004: no inputs found [ 268.029611][ T990] usb 4-1: USB disconnect, device number 14 [ 268.138363][ T7124] netlink: 48 bytes leftover after parsing attributes in process `syz.5.286'. [ 268.355794][ C1] vkms_vblank_simulate: vblank timer overrun [ 268.387964][ T7128] FAULT_INJECTION: forcing a failure. [ 268.387964][ T7128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.387985][ T7128] CPU: 1 UID: 0 PID: 7128 Comm: syz.4.287 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 268.387996][ T7128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 268.388002][ T7128] Call Trace: [ 268.388006][ T7128] [ 268.388010][ T7128] dump_stack_lvl+0x189/0x250 [ 268.388029][ T7128] ? __pfx____ratelimit+0x10/0x10 [ 268.388041][ T7128] ? __pfx_dump_stack_lvl+0x10/0x10 [ 268.388054][ T7128] ? __pfx__printk+0x10/0x10 [ 268.388065][ T7128] ? __might_fault+0xb0/0x130 [ 268.388085][ T7128] should_fail_ex+0x46c/0x600 [ 268.388102][ T7128] _copy_from_iter+0x1de/0x1790 [ 268.388126][ T7128] ? kmalloc_reserve+0xbd/0x290 [ 268.388135][ T7128] ? rcu_is_watching+0x15/0xb0 [ 268.388145][ T7128] ? kmalloc_reserve+0xbd/0x290 [ 268.388153][ T7128] ? __alloc_skb+0x112/0x2d0 [ 268.388162][ T7128] ? __pfx__copy_from_iter+0x10/0x10 [ 268.388176][ T7128] ? __build_skb_around+0x262/0x3f0 [ 268.388187][ T7128] ? netlink_sendmsg+0x642/0xb30 [ 268.388196][ T7128] ? skb_put+0x11b/0x210 [ 268.388207][ T7128] netlink_sendmsg+0x6b2/0xb30 [ 268.388215][ T7128] ? is_bpf_text_address+0x26/0x2b0 [ 268.388241][ T7128] ? __pfx_netlink_sendmsg+0x10/0x10 [ 268.388254][ T7128] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 268.388267][ T7128] ? __pfx_netlink_sendmsg+0x10/0x10 [ 268.388276][ T7128] __sock_sendmsg+0x21c/0x270 [ 268.388293][ T7128] ____sys_sendmsg+0x508/0x820 [ 268.388316][ T7128] ? __pfx_____sys_sendmsg+0x10/0x10 [ 268.388342][ T7128] ? import_iovec+0x74/0xa0 [ 268.388367][ T7128] ___sys_sendmsg+0x21f/0x2a0 [ 268.388384][ T7128] ? __pfx____sys_sendmsg+0x10/0x10 [ 268.388434][ T7128] ? __fget_files+0x2a/0x420 [ 268.388456][ T7128] ? __fget_files+0x3a6/0x420 [ 268.388486][ T7128] __x64_sys_sendmsg+0x1a1/0x260 [ 268.388506][ T7128] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 268.388533][ T7128] ? __pfx_ksys_write+0x10/0x10 [ 268.388549][ T7128] ? do_syscall_64+0xbe/0xfa0 [ 268.388563][ T7128] do_syscall_64+0xfa/0xfa0 [ 268.388573][ T7128] ? lockdep_hardirqs_on+0x9c/0x150 [ 268.388584][ T7128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.388594][ T7128] ? clear_bhb_loop+0x60/0xb0 [ 268.388605][ T7128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.388614][ T7128] RIP: 0033:0x7f90a4daefc9 [ 268.388623][ T7128] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 268.388631][ T7128] RSP: 002b:00007f90a3016038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 268.388643][ T7128] RAX: ffffffffffffffda RBX: 00007f90a5005fa0 RCX: 00007f90a4daefc9 [ 268.388650][ T7128] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 268.388656][ T7128] RBP: 00007f90a3016090 R08: 0000000000000000 R09: 0000000000000000 [ 268.388661][ T7128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 268.388667][ T7128] R13: 00007f90a5006038 R14: 00007f90a5005fa0 R15: 00007ffe959b2808 [ 268.388685][ T7128] [ 268.491522][ T7129] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 268.527210][ C1] vkms_vblank_simulate: vblank timer overrun [ 269.117378][ T7131] netlink: 48 bytes leftover after parsing attributes in process `syz.3.288'. [ 269.526300][ T7133] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 270.092550][ T990] usb 3-1: USB disconnect, device number 15 [ 270.621916][ T5809] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 270.771910][ T5809] usb 1-1: Using ep0 maxpacket: 32 [ 270.774527][ T5809] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 270.774582][ T5809] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 270.774621][ T5809] usb 1-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 270.774642][ T5809] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.780216][ T5809] usb 1-1: config 0 descriptor?? [ 270.872755][ T5894] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 271.754643][ T5809] usb 1-1: bad CDC descriptors [ 271.780928][ T5894] usb 6-1: unable to get BOS descriptor or descriptor too short [ 271.792778][ T5894] usb 6-1: config 160 has an invalid interface number: 186 but max is 0 [ 271.792802][ T5894] usb 6-1: config 160 has no interface number 0 [ 271.792842][ T5894] usb 6-1: config 160 interface 186 has no altsetting 0 [ 271.831189][ T5894] usb 6-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 271.831216][ T5894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.831232][ T5894] usb 6-1: Product: syz [ 271.831244][ T5894] usb 6-1: Manufacturer: syz [ 271.831256][ T5894] usb 6-1: SerialNumber: syz [ 271.963812][ T5791] usb 1-1: USB disconnect, device number 16 [ 272.100644][ T5894] qmi_wwan 6-1:160.186: probe with driver qmi_wwan failed with error -22 [ 272.119641][ T5894] usb 6-1: USB disconnect, device number 4 [ 272.505345][ T7162] netlink: 44 bytes leftover after parsing attributes in process `syz.4.295'. [ 273.451905][ T5894] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 273.492523][ T5809] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 273.545131][ T7179] FAULT_INJECTION: forcing a failure. [ 273.545131][ T7179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.545158][ T7179] CPU: 0 UID: 0 PID: 7179 Comm: syz.3.303 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 273.545173][ T7179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 273.545181][ T7179] Call Trace: [ 273.545187][ T7179] [ 273.545193][ T7179] dump_stack_lvl+0x189/0x250 [ 273.545217][ T7179] ? __pfx____ratelimit+0x10/0x10 [ 273.545233][ T7179] ? __pfx_dump_stack_lvl+0x10/0x10 [ 273.545252][ T7179] ? __pfx__printk+0x10/0x10 [ 273.545269][ T7179] ? __might_fault+0xb0/0x130 [ 273.545296][ T7179] should_fail_ex+0x46c/0x600 [ 273.545318][ T7179] _copy_from_iter+0x1de/0x1790 [ 273.545343][ T7179] ? kmalloc_reserve+0xbd/0x290 [ 273.545356][ T7179] ? rcu_is_watching+0x15/0xb0 [ 273.545370][ T7179] ? kmalloc_reserve+0xbd/0x290 [ 273.545382][ T7179] ? __alloc_skb+0x112/0x2d0 [ 273.545395][ T7179] ? __pfx__copy_from_iter+0x10/0x10 [ 273.545413][ T7179] ? __build_skb_around+0x262/0x3f0 [ 273.545428][ T7179] ? netlink_sendmsg+0x642/0xb30 [ 273.545440][ T7179] ? skb_put+0x11b/0x210 [ 273.545456][ T7179] netlink_sendmsg+0x6b2/0xb30 [ 273.545467][ T7179] ? is_bpf_text_address+0x26/0x2b0 [ 273.545493][ T7179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 273.545514][ T7179] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 273.545533][ T7179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 273.545547][ T7179] __sock_sendmsg+0x21c/0x270 [ 273.545569][ T7179] ____sys_sendmsg+0x508/0x820 [ 273.545590][ T7179] ? __pfx_____sys_sendmsg+0x10/0x10 [ 273.545613][ T7179] ? import_iovec+0x74/0xa0 [ 273.545632][ T7179] ___sys_sendmsg+0x21f/0x2a0 [ 273.545649][ T7179] ? __pfx____sys_sendmsg+0x10/0x10 [ 273.545706][ T7179] ? __fget_files+0x2a/0x420 [ 273.545725][ T7179] ? __fget_files+0x3a6/0x420 [ 273.545752][ T7179] __x64_sys_sendmsg+0x1a1/0x260 [ 273.545771][ T7179] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 273.545796][ T7179] ? __pfx_ksys_write+0x10/0x10 [ 273.545816][ T7179] ? do_syscall_64+0xbe/0xfa0 [ 273.545838][ T7179] do_syscall_64+0xfa/0xfa0 [ 273.545865][ T7179] ? lockdep_hardirqs_on+0x9c/0x150 [ 273.545883][ T7179] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.545899][ T7179] ? clear_bhb_loop+0x60/0xb0 [ 273.545919][ T7179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.545934][ T7179] RIP: 0033:0x7fe41aafefc9 [ 273.545949][ T7179] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 273.545961][ T7179] RSP: 002b:00007fe418d5e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 273.545979][ T7179] RAX: ffffffffffffffda RBX: 00007fe41ad55fa0 RCX: 00007fe41aafefc9 [ 273.545991][ T7179] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 273.546002][ T7179] RBP: 00007fe418d5e090 R08: 0000000000000000 R09: 0000000000000000 [ 273.546013][ T7179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.546023][ T7179] R13: 00007fe41ad56038 R14: 00007fe41ad55fa0 R15: 00007ffda1540dd8 [ 273.546052][ T7179] [ 273.551994][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 273.662421][ T5809] usb 5-1: Using ep0 maxpacket: 16 [ 273.664893][ T5809] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 273.664921][ T5809] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 273.664957][ T5809] usb 5-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 273.664977][ T5809] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.675408][ T5809] usb 5-1: config 0 descriptor?? [ 273.736960][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 273.737002][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 273.740869][ T9] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 273.740892][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.740961][ T9] usb 3-1: Product: syz [ 273.740974][ T9] usb 3-1: Manufacturer: syz [ 273.740986][ T9] usb 3-1: SerialNumber: syz [ 273.774894][ T5894] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 273.774917][ T5894] usb 1-1: config 0 has no interface number 0 [ 273.774949][ T5894] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 273.774963][ T5894] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 273.838637][ T5894] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 273.838659][ T5894] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 273.838676][ T5894] usb 1-1: Product: syz [ 273.838687][ T5894] usb 1-1: SerialNumber: syz [ 274.391343][ T7167] netlink: 24 bytes leftover after parsing attributes in process `syz.4.298'. [ 274.402817][ T5894] usb 1-1: config 0 descriptor?? [ 274.402872][ T9] usb 3-1: config 0 descriptor?? [ 274.406882][ T7167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.407401][ T7167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.444243][ T5894] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 274.447551][ T5894] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input12 [ 274.519130][ T9] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 274.679925][ T7164] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 274.711256][ T5809] thrustmaster 0003:044F:B654.0005: hidraw0: USB HID v0.00 Device [HID 044f:b654] on usb-dummy_hcd.4-1/input0 [ 274.711286][ T5809] thrustmaster 0003:044F:B654.0005: no inputs found [ 274.760698][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 274.775956][ T9] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 274.776054][ T9] usb 3-1: media controller created [ 275.084675][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 275.111617][ T5894] usb 5-1: USB disconnect, device number 17 [ 275.699607][ T7197] netlink: 44 bytes leftover after parsing attributes in process `syz.5.305'. [ 276.718246][ T7203] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 278.222119][ T9] DVB: Unable to find symbol tda10046_attach() [ 278.222143][ T9] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 278.222161][ T9] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 278.271977][ T5979] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 278.432941][ T9] dvb_usb_m920x 3-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 278.462350][ T9] usb 3-1: USB disconnect, device number 16 [ 278.585486][ T7210] netlink: 44 bytes leftover after parsing attributes in process `syz.2.309'. [ 279.364042][ T5979] usb 5-1: config 0 has no interfaces? [ 279.364076][ T5979] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 279.364097][ T5979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.421593][ T5979] usb 5-1: config 0 descriptor?? [ 279.525197][ C1] cm109_urb_ctl_callback: 205 callbacks suppressed [ 279.525216][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.525430][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.525621][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.525812][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.526001][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.526187][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.526416][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.526651][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.526885][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.527115][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 279.527313][ T5978] usb 1-1: USB disconnect, device number 17 [ 279.527345][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 279.672004][ T5979] usb 5-1: USB disconnect, device number 18 [ 279.933764][ T5978] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 280.191382][ T7222] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 281.089692][ T5979] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 281.232813][ T5979] usb 5-1: Using ep0 maxpacket: 32 [ 281.238547][ T5979] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 281.238605][ T5979] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 281.238644][ T5979] usb 5-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 281.238664][ T5979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.307605][ T5979] usb 5-1: config 0 descriptor?? [ 281.318801][ T5979] usb 5-1: bad CDC descriptors [ 282.028492][ T5791] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 282.401899][ T5791] usb 1-1: Using ep0 maxpacket: 16 [ 282.406955][ T5791] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.406985][ T5791] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 282.407032][ T5791] usb 1-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 282.407051][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.480121][ T5791] usb 1-1: config 0 descriptor?? [ 282.801942][ T9] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 282.820485][ T7252] netlink: 48 bytes leftover after parsing attributes in process `syz.3.322'. [ 282.906982][ T7241] netlink: 24 bytes leftover after parsing attributes in process `syz.0.318'. [ 282.930194][ T7241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 282.931248][ T7241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.005516][ T5791] thrustmaster 0003:044F:B654.0006: hidraw0: USB HID v0.00 Device [HID 044f:b654] on usb-dummy_hcd.0-1/input0 [ 283.005546][ T5791] thrustmaster 0003:044F:B654.0006: no inputs found [ 283.111852][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 283.113989][ T9] usb 3-1: config 0 has an invalid interface number: 182 but max is 0 [ 283.114011][ T9] usb 3-1: config 0 has no interface number 0 [ 283.114095][ T9] usb 3-1: config 0 interface 182 has no altsetting 0 [ 283.116837][ T9] usb 3-1: New USB device found, idVendor=05e9, idProduct=0009, bcdDevice=73.db [ 283.116949][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.116967][ T9] usb 3-1: Product: syz [ 283.116979][ T9] usb 3-1: Manufacturer: syz [ 283.116992][ T9] usb 3-1: SerialNumber: syz [ 283.126243][ T9] usb 3-1: config 0 descriptor?? [ 283.136564][ T5978] usb 5-1: USB disconnect, device number 19 [ 283.246361][ T7255] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 283.966186][ T9] hub 3-1:0.182: bad descriptor, ignoring hub [ 283.966223][ T9] hub 3-1:0.182: probe with driver hub failed with error -5 [ 284.165693][ T5791] usb 1-1: USB disconnect, device number 18 [ 284.220085][ T9] kaweth 3-1:0.182: Firmware present in device. [ 284.528529][ T9] kaweth 3-1:0.182: Statistics collection: 0 [ 284.528550][ T9] kaweth 3-1:0.182: Multicast filter limit: 0 [ 284.528563][ T9] kaweth 3-1:0.182: MTU: 0 [ 284.528574][ T9] kaweth 3-1:0.182: Read MAC address 00:00:00:00:00:00 [ 285.712190][ T5894] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 285.911093][ T7246] syzkaller1: entered promiscuous mode [ 285.924767][ T7246] syzkaller1: entered allmulticast mode [ 285.963900][ T5894] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 285.964149][ T5894] usb 4-1: config 0 has no interface number 0 [ 285.968200][ T5894] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 285.968477][ T5894] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 286.083739][ T5894] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 286.084646][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 286.084815][ T5894] usb 4-1: Product: syz [ 286.084963][ T5894] usb 4-1: SerialNumber: syz [ 286.442108][ T5894] usb 4-1: config 0 descriptor?? [ 286.476325][ T5894] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 286.479051][ T5894] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input14 [ 288.066323][ T9] kaweth 3-1:0.182: Error setting receive filter [ 288.066588][ T9] kaweth 3-1:0.182: probe with driver kaweth failed with error -5 [ 288.197144][ T9] usb 3-1: USB disconnect, device number 17 [ 288.516830][ C1] cm109_urb_ctl_callback: 1 callbacks suppressed [ 288.516854][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.518632][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.518887][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.519124][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.519355][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.519583][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.519810][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.520055][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.520289][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.520521][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 288.659847][ T9] usb 4-1: USB disconnect, device number 15 [ 288.659972][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 288.932585][ T9] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 289.422785][ T44] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 289.489709][ T7291] syz.4.332 (7291) used greatest stack depth: 17800 bytes left [ 290.404547][ T44] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 290.404573][ T44] usb 1-1: config 0 has no interface number 0 [ 290.404621][ T44] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 290.404646][ T44] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 290.406922][ T44] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 290.406948][ T44] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 290.406966][ T44] usb 1-1: Product: syz [ 290.406979][ T44] usb 1-1: SerialNumber: syz [ 290.494301][ T44] usb 1-1: config 0 descriptor?? [ 290.524687][ T44] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 290.528031][ T44] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input15 [ 290.644573][ T5894] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 290.792493][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 290.875729][ T5894] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 290.876524][ T5894] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 290.877118][ T5894] usb 3-1: New USB device found, idVendor=0421, idProduct=00a0, bcdDevice=c8.e1 [ 290.877270][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.031537][ T7287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 291.435255][ T5894] usb 3-1: config 0 descriptor?? [ 291.461213][ T5894] usb 3-1: bad CDC descriptors [ 291.669968][ T5894] usb 3-1: USB disconnect, device number 18 [ 291.951830][ T5894] usb 1-1: USB disconnect, device number 19 [ 291.952581][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 292.007496][ T5894] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 292.107313][ T43] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.221878][ T44] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 292.272292][ T5894] ================================================================== [ 292.272308][ T5894] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 292.272343][ T5894] Read of size 8 at addr ffffc9000dd49008 by task kworker/1:5/5894 [ 292.272358][ T5894] [ 292.272368][ T5894] CPU: 1 UID: 0 PID: 5894 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 292.272388][ T5894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 292.272399][ T5894] Workqueue: usb_hub_wq hub_event [ 292.272418][ T5894] Call Trace: [ 292.272425][ T5894] [ 292.272433][ T5894] dump_stack_lvl+0x189/0x250 [ 292.272459][ T5894] ? __pfx_dump_stack_lvl+0x10/0x10 [ 292.272481][ T5894] ? __pfx__printk+0x10/0x10 [ 292.272500][ T5894] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 292.272522][ T5894] ? __virt_addr_valid+0xdc/0x5c0 [ 292.272544][ T5894] ? __virt_addr_valid+0xdc/0x5c0 [ 292.272566][ T5894] print_report+0xca/0x240 [ 292.272587][ T5894] ? __list_add_valid_or_report+0x4e/0x130 [ 292.272604][ T5894] kasan_report+0x118/0x150 [ 292.272627][ T5894] ? __list_add_valid_or_report+0x4e/0x130 [ 292.272649][ T5894] __list_add_valid_or_report+0x4e/0x130 [ 292.272669][ T5894] kcov_remote_stop+0x52d/0x660 [ 292.272694][ T5894] hub_event+0x45d2/0x4a20 [ 292.272717][ T5894] ? __pfx___schedule+0x10/0x10 [ 292.272739][ T5894] ? do_raw_spin_lock+0x121/0x290 [ 292.272758][ T5894] ? register_lock_class+0x51/0x320 [ 292.272785][ T5894] ? __pfx_hub_event+0x10/0x10 [ 292.272802][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.272825][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.272843][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.272862][ T5894] process_scheduled_works+0xae1/0x17b0 [ 292.272892][ T5894] ? __pfx_process_scheduled_works+0x10/0x10 [ 292.272923][ T5894] worker_thread+0x8a0/0xda0 [ 292.272943][ T5894] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 292.272967][ T5894] ? __kthread_parkme+0x7b/0x200 [ 292.272991][ T5894] kthread+0x711/0x8a0 [ 292.273017][ T5894] ? __pfx_worker_thread+0x10/0x10 [ 292.273037][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.273056][ T5894] ? rt_spin_unlock+0x150/0x200 [ 292.273074][ T5894] ? rt_spin_unlock+0x161/0x200 [ 292.273089][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.273111][ T5894] ret_from_fork+0x4bc/0x870 [ 292.273131][ T5894] ? __pfx_ret_from_fork+0x10/0x10 [ 292.273152][ T5894] ? __switch_to_asm+0x39/0x70 [ 292.273168][ T5894] ? __switch_to_asm+0x33/0x70 [ 292.273183][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.273205][ T5894] ret_from_fork_asm+0x1a/0x30 [ 292.273226][ T5894] [ 292.273231][ T5894] [ 292.273236][ T5894] The buggy address belongs to a vmalloc virtual mapping [ 292.273252][ T5894] Memory state around the buggy address: [ 292.273261][ T5894] ffffc9000dd48f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 292.273273][ T5894] ffffc9000dd48f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 292.273284][ T5894] >ffffc9000dd49000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 292.273296][ T5894] ^ [ 292.273304][ T5894] ffffc9000dd49080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 292.273315][ T5894] ffffc9000dd49100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 292.273330][ T5894] ================================================================== [ 292.273348][ T5894] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 292.273360][ T5894] CPU: 1 UID: 0 PID: 5894 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 292.273379][ T5894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 292.273390][ T5894] Workqueue: usb_hub_wq hub_event [ 292.273407][ T5894] Call Trace: [ 292.273413][ T5894] [ 292.273420][ T5894] dump_stack_lvl+0x99/0x250 [ 292.273442][ T5894] ? __asan_memcpy+0x40/0x70 [ 292.273460][ T5894] ? __pfx_dump_stack_lvl+0x10/0x10 [ 292.273481][ T5894] ? __pfx__printk+0x10/0x10 [ 292.273505][ T5894] vpanic+0x237/0x6d0 [ 292.273521][ T5894] ? __pfx_vpanic+0x10/0x10 [ 292.273540][ T5894] panic+0xb9/0xc0 [ 292.273555][ T5894] ? __pfx_panic+0x10/0x10 [ 292.273569][ T5894] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 292.273590][ T5894] ? lockdep_hardirqs_on+0x9c/0x150 [ 292.273611][ T5894] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 292.273633][ T5894] ? __list_add_valid_or_report+0x4e/0x130 [ 292.273651][ T5894] check_panic_on_warn+0x89/0xb0 [ 292.273667][ T5894] ? __list_add_valid_or_report+0x4e/0x130 [ 292.273686][ T5894] end_report+0x78/0x160 [ 292.273706][ T5894] kasan_report+0x129/0x150 [ 292.273728][ T5894] ? __list_add_valid_or_report+0x4e/0x130 [ 292.273750][ T5894] __list_add_valid_or_report+0x4e/0x130 [ 292.273770][ T5894] kcov_remote_stop+0x52d/0x660 [ 292.273794][ T5894] hub_event+0x45d2/0x4a20 [ 292.273817][ T5894] ? __pfx___schedule+0x10/0x10 [ 292.273838][ T5894] ? do_raw_spin_lock+0x121/0x290 [ 292.273858][ T5894] ? register_lock_class+0x51/0x320 [ 292.273884][ T5894] ? __pfx_hub_event+0x10/0x10 [ 292.273901][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.273923][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.273941][ T5894] ? process_scheduled_works+0x9ef/0x17b0 [ 292.273960][ T5894] process_scheduled_works+0xae1/0x17b0 [ 292.273990][ T5894] ? __pfx_process_scheduled_works+0x10/0x10 [ 292.274016][ T5894] worker_thread+0x8a0/0xda0 [ 292.274036][ T5894] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 292.274059][ T5894] ? __kthread_parkme+0x7b/0x200 [ 292.274082][ T5894] kthread+0x711/0x8a0 [ 292.274105][ T5894] ? __pfx_worker_thread+0x10/0x10 [ 292.274123][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.274144][ T5894] ? rt_spin_unlock+0x150/0x200 [ 292.274161][ T5894] ? rt_spin_unlock+0x161/0x200 [ 292.274177][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.274198][ T5894] ret_from_fork+0x4bc/0x870 [ 292.274217][ T5894] ? __pfx_ret_from_fork+0x10/0x10 [ 292.274238][ T5894] ? __switch_to_asm+0x39/0x70 [ 292.274254][ T5894] ? __switch_to_asm+0x33/0x70 [ 292.274269][ T5894] ? __pfx_kthread+0x10/0x10 [ 292.274290][ T5894] ret_from_fork_asm+0x1a/0x30 [ 292.274314][ T5894] [ 292.274693][ T5894] Kernel Offset: disabled