last executing test programs: 1m46.532634975s ago: executing program 1 (id=1090): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x141, 0x0, 0x4}, 0x18) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f002, 0x4}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffbc, 0x10, 0x20}, [@ldst={0x7, 0xff05, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10002, 0x110) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000002c0)={0x2}) mknod$loop(&(0x7f0000000200)='./file0\x00', 0x85c68e8ab9c77084, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0020001000010800004a00fcffff2b78fa7adf8e", @ANYRES32=0x0, @ANYBLOB="000000000420040014002b80080003001900000008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x3c}}, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) gettid() r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000100000027bf000000050000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000ce9cbdaa4db4aeb85a68703a4b13b0966af637ec63a49b8fa431a770363f1ba45fb1d0768f705d2cc321e86e211b778ea92ea3c398351d2641a9482e626d31c4071810c5a95c3b87483fcb25a24565a5d688d8da35fb50cd2e6b17b5650801c513e80b7052e2f9fffd98db75066165a23bcf73548ab3761111072aa687a0e1b35af18f6c1e723e29d17670bad070e15682b16be2a6613d0466e0b1cd2141b801afadfdaf16c5c8c6733f6480dbf2cb4038984962d5d18efe5e0e1331a35a13c51e1cb6a2b89653fdef3b3263bfbd500f201a64c694195ccec55dafa45a595658ca4cf47a22db3c352e72dd32d772ca24a28079f412549af394ca949dcabd526bf78fce900aae1ab2751420d98abc526eec270000000000000000"], 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r6, 0x0) 1m45.46342966s ago: executing program 4 (id=1094): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x3f, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) (async) syz_io_uring_setup(0x6ec7, &(0x7f0000000080)={0x0, 0xfffffffd, 0x10022}, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000480)={0x14, r2, 0x1, 0x0, 0x0, {{0x2}, {@void, @void}}}, 0x14}}, 0x4040) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "25ace3f62b00ee00", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3ffd9afd96e6c0"}, 0x38) (async, rerun: 64) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) (async, rerun: 64) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000100)={0x3, &(0x7f0000000000)=[{}, {0x94, 0x0, 0x0, 0x3}, {0x6}]}, 0x10) (async, rerun: 64) shutdown(r0, 0x1) (rerun: 64) 1m45.127381874s ago: executing program 1 (id=1097): sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='>'], 0x38}}, 0x80) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0xfa, @scatter={0x0, 0xfeff, 0x0}, &(0x7f0000000000)="1c3513000000", &(0x7f00000001c0)=""/4103, 0x0, 0x0, 0x0, 0x0}) 1m45.061394618s ago: executing program 4 (id=1098): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = semget$private(0x0, 0x20000000102, 0x0) semop(r0, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000040)=[0x807, 0x3, 0x9d]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) execve(0x0, 0x0, 0x0) sched_setattr(0xffffffffffffffff, &(0x7f0000000100)={0x38, 0x0, 0x40, 0x8, 0xab9, 0x75, 0x3, 0x348, 0x8, 0x3ff}, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x400080, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r3, 0x1, 0x53, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r6 = socket(0x10, 0x80002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mkdir(&(0x7f0000000180)='./file0/../file0/file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file4\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}, 0x1, 0x0, 0x0, 0x8811}, 0x8800) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xfff3}}}, 0x24}}, 0x0) 1m45.002949223s ago: executing program 1 (id=1099): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000040)={0x10000, 0x240, 0x0, 0x0}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fda000/0x18000)=nil, 0x0, 0x0, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m44.6209937s ago: executing program 1 (id=1100): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, 0x0, 0x0) set_mempolicy(0x8004, 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x101, 0x0, 0x3}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x9, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bind$alg(r4, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="69db2abd7000fcdbd7251000000076a557c07c61d71a1f6ce424f53dfd833836d53515d6a49c4ab1933a3ad0eb9a4d9e6513899a893a0c9501905fac6c0e7f59c148286d4148deacfcea596a964a87194e6e4082ed"], 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x4004880) r6 = accept4(r4, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) getsockname(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) sendmmsg$unix(r6, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) 1m44.446518387s ago: executing program 3 (id=1101): pipe2(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) vmsplice(r0, &(0x7f00000005c0)=[{&(0x7f0000001cc0)="b70cdbd771882612c450d694c9dd7d7f28d237e84e2780ca6428d132e03f188fff6bd9f85ead7e68f90830db9295022700491841f4a15a000aa4e29ac23601041ec521aa0ea8044f23feb74151693f228ba89f0a43385617bc7930f30a52ca91d02c64bd39d3d581abe9089b2284f876f9c58c124aba7a28700efcb0588ff4ab54a62c0c64fd577d85f5f753ec15281cf73fc37442b0a5ca4a1818cb01590d6415b1e9fda6c7d63cd293d7cc7ca5581041a2736e95b9b0322880b5fd7f27c0d4a59df8101b755fd6cc495963381c8a95d5d605b8ef4800b47091c8749f9e8e9fce163e46db0f7c0e4d0d3a621e3c999453e95aaa56090f220b220c50b31b9d6af722477ab1cda6d561156d85c658a3cd42d777314d154bf31bb61918ac7de8bfad7a5825be505af82806130e8dd03816b86086cc3361bf3a2a0cf6c18b7c84503477660ef5a0bf92d8169c43df1d7bb140652c799a4ac292b94fcea7f0c74413791879104e2bc9b414eda6c74f3625299f67d03e3ef58eeae5ca5fb029005ffa0fe23fb541bc24a57e9c6d8169702998273789ee8c9f08132ab9f76c02a6696c3ad68bf7a772d8be6b1840cfad2184edcf10bd5620f51657239e8eb49b8e77c1483dcc3dc04aeb6cae2922af4be346d52f2983dd5330cbef40b3207432ea6d2a6d2ffb0c3440c78add8395da089aa80e21d8692b16582edea583b73266fd1ab37abc02aa89310ed72a827153f1cbba0f76147a09977724706fdcd68ac168ceb433eba816f55bb5069924c0a6c59b1116e27de7938b835c467dbd9be1843913748e5a2e6f6621bf4944045d82b5124d23fa1d87e780b54a6955a51e47fbf36432be1b3d9d01c05d86e390e497856e476ce5b101c837cef62edce520860667c5259478602febbc5e87f216a6f1452b285f44282333569cbd2f49613730b86a74485e49e1979690ee2c11e1fb49d642c9f515d9e0cf30fe8995379b0b4b2177b2541a34cef72af676c2402b3ab03993047186d45016f83a735b7babda7b3e408f9a7b5c36e7daaaad51e437060c8a5a07646a31a43ebdda0b12a3f64f963315febebf0ad610f2ec9500717c4f33d8bf0e5b55ed2a976339643658df80f07bb29f5fac6f25957ef64ef1bac93f0ea64bfea48b38a4985ff610259762996044543bdf2c", 0x341}], 0x1, 0xa) fcntl$setpipe(r0, 0x407, 0x6) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000004c0)={r0, 0xffffffffffffffff, 0x32, 0x0, @val=@uprobe_multi={&(0x7f0000000400)='./file0\x00', &(0x7f0000000440), &(0x7f0000000480)=[0x4, 0x4, 0x3, 0x5], 0x400, 0x0, 0x1}}, 0x40) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000009c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010400000009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000380)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="4010090000009f04b42913d0e0c1d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000429bd7000fcdbdf25110000002000018014000200000000000000000000000000000000000800030001000000"], 0x34}, 0x1, 0x0, 0x0, 0xc894}, 0xc0) r3 = open(&(0x7f0000000140)='./file0\x00', 0x10900, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmmsg$inet6(r6, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="5e60e574da93883e8c628a600b17cbe584d2e73c681419", 0x17}], 0x1}}], 0x1, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r4, 0x80189439, &(0x7f00000003c0)) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="ec000000ca3848c24b4a7d32640c8793ce1589c320b39a5fee46d168bc40d0086927aed47e913a1b2cc3ffb73e56c9592955cf96740d8c5d6038244548f15dd09b41ea0024697394953df387109cfbffffff1ae10c7900f04a64b643855e3b8c8d6b29207b2349248690d4d684cd6a402f193a89765371fa202fb35989f085062a88a64b32ff55ceb4740ae6d96982e8f3000e0035bd772da7f5901fcd86477b8316aa5ab1b350f22fa75667207af71678eaeae9ceffdcedd04e8f", @ANYRES8=r3, @ANYRES8=r7], 0xec}, 0x1, 0x0, 0x0, 0x44081}, 0x80) bind$inet6(0xffffffffffffffff, &(0x7f0000000380)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0xe67}, 0x1c) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05"], 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x40044591, 0x0) writev(0xffffffffffffffff, &(0x7f0000000f40)=[{&(0x7f0000000c40)="e39b7d4ed2e7cf6d3ff5500217062178cee1f16f6f01f383", 0x18}], 0x1) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) 1m44.350251578s ago: executing program 2 (id=1102): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) getegid() bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000300)=0xffffffffffffffff, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xe) gettid() openat$userio(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x33, 0x8, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x74}}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000840)) pipe2$watch_queue(&(0x7f0000000880), 0x80) r3 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0xff06, 0x0) 5.421301127s ago: executing program 2 (id=1105): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000240a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400000000f0800014000000000340005800c0001007061796c6f61640024000280080004400000005608000340000000b9080001400000000a0700024000000b000900010073797a30000000000900020073797a32"], 0xc0}, 0x1, 0x0, 0x0, 0x4}, 0x0) 5.421056239s ago: executing program 2 (id=1107): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000040)={[0x100000000]}, 0x8) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f00000000c0)=@attr_other={0x0, 0x4, 0x9, &(0x7f0000000080)=0x8a}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x23b, &(0x7f0000000380)={0x0, 0x61f0, 0x10100, 0x2, 0x2ea}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, {0xa0b0}, 0x3}) io_uring_enter(r3, 0x2ded, 0x4000, 0x0, 0x0, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000190001090000000000000000021800000000fd010000001008fc0000ac141400100016800c0001000000000000000fff080005000a010121060015000600aa3002000008000b000c000000"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 5.417677435s ago: executing program 2 (id=1111): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) syz_open_dev$vim2m(&(0x7f0000000100), 0x5, 0x2) syz_open_dev$vim2m(&(0x7f00000000c0), 0x253, 0x2) r0 = syz_io_uring_setup(0x1244, &(0x7f0000010180)={0x0, 0xd5a5, 0x800, 0x40000001, 0xb8}, &(0x7f0000000400)=0x0, &(0x7f0000010200)=0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@private2, @private=0xa010102, 0xa, 0x1c}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) kcmp(0x0, 0x0, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xdfffffffffffffff, &(0x7f0000000340)=[0xffffffffffffffff], 0x1, 0x0, 0x1}) syz_usb_connect$uac1(0x0, 0x71, &(0x7f00000009c0)=ANY=[@ANYBLOB="12011001000000406b1d0101400001020b0109025f0000000000290904000000010100000a5b010900080203000000000000000200000904010101010200000905010908000706000725014106a60009040600000000000000040201010102000009058209ff037f028107250100090a00"], 0x0) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000300)={0x9, [[0x5, 0x5, 0x51ea9978, 0xe6, 0x3, 0x2, 0xfffff07c, 0x8041], [0x7, 0x18, 0x4, 0xf35, 0xfdff, 0x7, 0xfffff801, 0x7], [0x80000000, 0x7, 0xffffffff, 0x9, 0x7, 0x8, 0x800, 0x5]], '\x00', [{0x8000, 0x2, 0x1, 0x0, 0x1, 0x1}, {0x7, 0x2, 0x1, 0x1, 0x1}, {0xf, 0x8, 0x1, 0x1, 0x1}, {0x2, 0x2, 0x1, 0x1, 0x1}, {0x9, 0x8, 0x1, 0x0, 0x1}, {0x9, 0x2, 0x0, 0x1, 0x0, 0x1}, {0x1, 0x4, 0x1, 0x1, 0x1}, {0x0, 0x5, 0x1, 0x1}, {0x7, 0x4, 0x0, 0x0, 0x1, 0x1}, {0x2, 0x8f, 0x0, 0x1, 0x1}, {0x3, 0x8, 0x1, 0x1, 0x0, 0x1}, {0xe6, 0x3, 0x0, 0x1}], '\x00', 0x2}) 5.416892701s ago: executing program 0 (id=1112): r0 = socket$inet6(0xa, 0x80002, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x0, 0x5e}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, [@tmpl={0xc4, 0x5, [{{@in6=@empty, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@broadcast}, {{@in6=@mcast1, 0x0, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}]}, 0x17c}}, 0x0) (async) openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x7c61d607c6d94c11, 0x0) (async) socket(0x2, 0x80805, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000010900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000050000000060a010400000000000000000100000808000b400000000028000480240001800b0001007470726f7879000014000280080003400800000a080001400000000a0900010073797a30"], 0xc4}}, 0x4008800) (async) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) close(r5) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="8c0000000906010200000000000000000200ffff08000940000000390900020073797a310000000005000100070000005c0008801c0007801800018014000240"], 0x8c}, 0x1, 0x0, 0x0, 0x10000182}, 0x4000080) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x9}]}, 0x10) (async) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) syz_usb_connect(0x5, 0x2d, &(0x7f0000000380)={{0x12, 0x1, 0x310, 0x1f, 0xcd, 0x1b, 0x8, 0x10cf, 0x5503, 0x75af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x8, 0x9, 0x10, 0x3, [{{0x9, 0x4, 0x18, 0x2, 0x1, 0xb4, 0x1d, 0x3f, 0x1, [], [{{0x9, 0x5, 0x85, 0x3, 0x20, 0xff, 0xa, 0x40}}]}}]}}]}}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) 5.415042356s ago: executing program 0 (id=1113): r0 = socket$can_j1939(0x1d, 0x2, 0x7) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="0401000010", @ANYRES32, @ANYRESHEX=r0], 0x104}}, 0x800) connect$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0xf6, 0x0, 0x1, 0x0, 0x6, @random="b13ed114c4b9"}, 0x14) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00000fae00)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f00000fb000)={{0x0, 0x8, 0x6, 0x4, 0xff, 0x1c, 0x8, 0x80000000, 0x8, 0x2, 0x3, 0x6, 0x1, 0x7, 0xed0}}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000fc000)={0x4000000000000, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x2, "8a289b0ace824c"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00000fd000)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f00000fd200)={{0x0, 0x2, 0x4, 0x0, 0x4, 0x3, 0x6, 0x9, 0x10000, 0x8, 0x4, 0x3, 0x7, 0x1ed, 0x40}, 0x50, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00000fd2c0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000fd4c0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f00000fd6c0)={{0x0, 0x3d0, 0xd6f, 0x8, 0x5, 0x7, 0x4, 0x0, 0xfded, 0xfffffffc, 0xf, 0xfffffffffffffff8, 0x2, 0x4, 0x9}}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00000fe6c0)={0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f00000fe8c0)={0x0, 0x0, "029e673c1ce0c3cbecd01459cec9333f9084f59b1dc3b2db4da90cf174aacaaefe93e59bef35aa2f219feaebfde7a9c7451db5a5f822413b730c3a6c5705a85febbdf8766192204e10d00b2fe341b727d3cfc1c866709d9eca43f8019ddc90ef53e2d9ac0296c74a9e42371a302de84ec73adfd7f8bf6280a93c670f958d161a5d7ceb9efac44c58333f7441bce1a4918bdc39730fdef20f0a43cfa4b8f3aa33cd3ac2bd0249721253a95e90565640711c017b0bba924169fa0aba8ed3a23ac1f1dc43a1936757eee260311a2dbca6df5362325f96a3f86427c5a4d5b20326dafd53d4d7bc58076e635e7f2d011dd5310a2068f8ef872514ea87df60cbc97fac", "a3a71d2364660b4f57a82843022d9be64f0bb4762a500b3fa346364ba241701c768f0ed729329f0b52394a3de1781747fa366abb5c45d0f164f67423d7f46206a45a006084b633f77296a26c64714f6e8839a69d9bde7cce99428d3a59c25075bef0d91b18cc33b05d82cb80e490749d479e3a5b2e4699a8489805fda1d322eef44965b4b60d738efa75f70b02c4f9a2e64141241531b7aedaefd5cf2297963e330db6834d05bea1afb3190613046c06e0f0d402e2f4f2cafd373cd99c125b3854a3714fa3603f91dbb641dad5ab68d483f2c34790044ade196cbd723373b5aa650c9b72039d1e8abc3a6ff49c4230f6ea614b0837b1792c7b754c5a854c92a1b291a9c05ae0e812aac0ffd8b30a5a04244724f723b5ebd6c717b58d1441d0e42c5f23dd79b2ee09975e214b59cb1272f973d26b4b0c41c2c6c3b5332b6f736c2da3323bbb357cb88439327f0f8d85f2a211bbbfb768bb26c430e29e6f02d88b8b68fd72896bf3d69c6275cccbdeb8eb9281a2b469c2d82424084c797e77760f8c7d48697dce3185a62f41cc42bf88c7e6178ba127c247dfe5ff1d56f7c0bc700479619034e63de6911ba7fca2f2585ea5a4ab544d90fdc03f8b430859f6de180977b81fa1242b0dfb2a208aa1d6f132311306f1f8e0c74e2769cc5c37519606cf483e1b7ad0798b9bfb104efe10ad29b944ffaa7d466cc242afe5a3c2d705eef834d45e5be00f0a82d1b5be7686c79d5b45d313ba649a76e64cfbc0ca8f4dfc988b9e13d983e7050483bd94e077732f7bd05788053e57c3bc9b84fc49ac9fea2f517a40cea98b6ec3e498e73e4bd86b5cb4c847264314dc844eb8dfa1ccc5289ac0342026c2b813ceec73e4cc0ae927973fdf28c295ab971dd2ae170e3cfa2e7aa159cbe708cd2b5e6e452df296be7046f738a5af4dbf957c1a5219c1a5c52c22e7770f585abab976876c81c8472f45aaaa16fc6eb1b4d6291f5601bef267174f7ec0c42181405b430a0b2799ce9326b743d3e6653acd73a50028c15dc3c5e67c97c7bcfe6c6ec2c41e74cf2031f47d48116d544d317e537b70ca33e5954ee13670c74cb03ce81b765bb6f9a72fdde5decd37b6524eab0c41beab51d1d1be1b41cc957773faf6762d2726d16c3264d1ee5bd32f1824620171c1f6f1079521d83c16435b2523c813fe2b8f213e79a28a4c7b5ab2f248d507e4103e1d33d0ec8bfc067523270e55be9d83276ce9fcd0e970beb757d51199802a837a88259cef1687ba1d58dab19e42f53e1e07e221aff4a24d0ca5d729ca93ee14a2719c6503ec137933f4da2b0644ceae9a62a74697683ddea72e7813807ee95826db84a0d3baada81ca068628751399eec22df76defa98f1332986faa665638f848a9f0fde20a300ad50b496c073a3e7cc6a81e58babfd0738ee7f464c54c1e1756c8fdda2f9f6a9a1a23a8b18106f226c6d253ef3f486e2c415ddaefd27a7b96410ef8548e65d97ecd8da7e5ba63762494c28c304f02f47be8e573b491ddff9845e230339331a2d774e0091affdfc8210f501b5bfdb1d3bc1c1a192e60bc3e4ce52f843689bbe20dab592015258d89acfb5a4fb6e47d1d0192f88c2853b0b9944f1fb37f868750ed191dbbc179e04e8175aff98cc6ae7df43229731755ade793a67b3820bdf451d8edb4e63988d7886fbe0bc75d160a0dcc05937ef088a92878e3b2e6c6f312872fecdf130264f6b5d3df3e56ec86afa8dd0df3513f9a424e8b5fa5edaa5589cf2bd1b32542504d4a9bd76205e7f2418dca65d9e742c3c8ef5018d104712ad937517904839ffc2dc2d633db3be224ca30ca61053ef62422fc6232b5f8d55427346a6e6961e094032b2e1fdde83ac002a307d5213a8f201a75f24a610edaa8087f704bdfbc6fd0d3b54c8a58f188081448881c57f7ee52a6dc7b5f68a5096f54be48871fe89ae5c6779dd7681d5294768f5d62d043e0e941784eca0876217af1466478d2a7e38b263316ab1235f09e6c4483eeab53dbd885ffbd91ff0217108812b3a6846604574866d9a79e1560d585a9fcf8023246a7c9db6a42fb1a800ce6616ffe8688daea50dbaf47838ff56dff0e0cad3df8ab051d3e5e6638fd5844f2517e6aa91d456eee342ef981b0dce47a5a8979445fce81418771a5adc234a939e4bd08089a4b8fbeb2858a8d4a8af508c3aa38fa4c9b8e91b0209e8de8679d0f4c0ad0e72db419ce01be803a23d88ee34a6702ce03d846dcfb73c810cbca34f00d78032e9d31b95e973caa58c9b99a887bfe58403471abfefb1c058823111762be52abc50988f544dda34da347e441cd810fa6520fbb15516cb89ccfccabc86de55ceb1ab5fe446f660d014648b5246f7d3f59ec8739b18ace78f8db45d9323133c963e7b653bba0a6ff0dad5affc8e4343ecdbfb2c6c085855c092bd49f1cb7834556281767d43166c6c482a1ff0d19e7f4687aaedc8b93e52abefaf3068cceec272a590f628b439ea40e5fb5b406c2e683a7ddc062e34681daaa31b26ec14643483e6f8dd8a609b1458d7cfae84eb6f5ea50870912e4b837964871543dad8c28a0894c0cb19244759f5ef56a6f0745dc4a0e2226c7f6584961546de479624e1f1c2a281064158178d2e5de08be1bb2ba6341fa61610a98bea01dbec9e492c1d9f502ebd030af6ed52ee7417a57eb583d1f67dabb3dabe1b700594688ac1b7637ef691842a3be308f8c86850a8cae6b75ca8e1599d618ba61a07e1020e0cd93dfc90f164c680d76d758d1fa534dfd8ab950116bd6090a981c0667a2b6ba54773cbb5ea65a989d38235cb4268e79159c14f6159a0900a94c8020df3ab41cf0538e50d7006e39f2ceaa803cf4fb8172d142cac27e34e7f88af120a30066d63c19769d181de217ab5a202978bf9287f47b433b4a70a635a28173f430980cf7cea016e470d951e363c0577f19c866b22cab88c5ee71f711cec0a2dbc85c4dbf6168c446f31b6785a62a8742f3054ad8e3ccc7886079f691a5acf32e70a812a1e8007fb27bdc45f11fbd1e392d6839befd567c02ff4f876ec25f9f63bcdfa9175737630e06858ec4fbbda0374a7d2f079f55ed4abd6ce08970b9b457ad425f3f8cbbe388e91b574324aff71c0937c9bb69499238094387e856f892ecd0f51b7ab0abdd55152af4cb5dd83b69b9bf86f887d576e31d5e616ffa09e0b02c80c256e6faf8f010db984d601f59817717ffe88c6d82e83d5e3a1fc4c147a36b72de3dc2b69ab6b278d1f088af8a0eddfe003fca7058444ccad4a2ad20a629554d5eaf4f77c0a95361d87a7719583876d2970a11b6a47f6f2fa5ed7758eb166a1ccef37108c2a32eedd482655d64a13b8e00447257ec6c14c38e5acc38052174a5741c1f270505f7ee52ac9b66e2809b7b905168ddeac03984ef2aa9475366ba7195d74b15f6f55efbf119a347eeee59174eb05d337171303d4d852d452f04a52ee68155ae621772cdd1060af98c9a25a6006af2372f25735a7c51ebd34014cac32c6c8d333e9523d97427573c277a2e5b5cf6c2edcb453fd058a0bd04e884a0326ba27ecfb4effb5ff21fa079866735271d70c25cb57705aaa1a107c1cfc7a197f8bd8c5c2691fe89c647969c1a199dcec0cbb88c06bc228881dc88a4a5e1b184b854a7072ba6fa976371dac08d6a5fe3b6644b547dd6435c6281c6f74a27733aff876d90077b8fcd59a8ac21d9280b65ae41d4c3d3952163d5dd1d567e17b1a2544c6de8e4f47a06eb29a4fc518dd1173d688762625f86ae24052e0f5b231898635f018fc26ba99b6852fb00b67d2f2133c272c3ebd567560dcfda5613b74a96c6a019117a748c97b2f3bfa4881219eff7ca5e2d36c281795f86a30e180d424857e86b71f99b01b95b9c1f0a1c7d7cf48219b309462de4bb484686e69fd459c762b42e35ebd1cacea5446e5d3c2301cf49faf86c1a625cebe972c954c123b994669a2ca5d5ae926cfdd650feddc8ff6b5361f71e943fd576722d302978fb1ea939717795e11bd72753efa4b40e5fa1388d402a2dfa38f55c075d7bcb80b9eb224a9d6f44548eb1dba9d2912088b14f63137bf4e07844d9b9ed1e79e3d544aad99360f86f8a861df3546e7c97655c15b1d22ebcb62d31cf5ea9885a5b15b6cb3fc67ce0480bb5b15f289b1e7647d205afa28515a60f218b4f78efabe6172089fe14a4db45770ac34bd8631d4ef74f354aeb4907f58d9f481af28f2bc4c5fcc79dfc16f163233eb0e415eaed958eb378d299b0c65642232ff0e404d37260c6ff02cbcd3fb9fe9519e5c4fb8e75d4e8fb9877bff7afa71c0f1843c2898d61e151e8509fa96a738d302de1f46c55eef6d9ba0f68c14bcb59090ebed9b99103988c2bd7e0a525b3c81959adc95967a397566ba00c5f32db20fc2fc800e48d48be920ceb0c1fef0df598f76ba7c70232c5d108930cea24bb6a39538cb19450e82a5948109fc82b8276cea00173aa93fd63137ba55bfcff1bad1e9fcfdd03228916d0de068935e85d27c922d08458e7c575aa71a411d16e2e4f1213d0ef9268adbb0cf53710252d218efee4f81511850e2296383fe968aedaa86e9918e5c99b66a8e199974931fcfa07a62334a77b8d42a7140506837953b2a9dcd4e933fa48c8a74bec319b3098c1ebce9843df0599ef8fe822d54e911b9f65eb27a5af41922d1f8fc24890d1722423b3c21c0367019f7bc149b2aebce02cf5068fa494f28453213f21a26adabae6dd0264aaddd3d60e709d0e358ae9eb439873519024bfe94bfd6eb91fce324b14a5ef9164266e20b04a7ddbf7d3682a516ad1726a34fc9835ec5a4792bfa2cfc34dc72739dda07219e795acba07ae6c5b67ed40cd41ad238f0c1c4ced1ce1ee1ae2d4627f748111722a5f6e1e30a720215273c0805c4fd991b097e51f035625ecd02acbe672001b19fd1e20612c00ad61fb48dbf36208e6d9b90c39992858e334e89bc2f7858d2ee77c6ab3c8440f6f2ec9664fbb9ef291440dd6da71e6cb85196408f57007ba322ace56fe6147413fba4d3b3777ffb52cba798e0cc7a084082652a1c38ab2ee38e1526a6b0b40866f016c3ea65147c83d0e6709cd60b401e01eede91c7a922a8137cc03d8d268c12cee06cdf6697e40449cfd8358db7544d8806d7e384d2eaa94d23795d679077dd95723ce3353fdb3c0020232de7ba13ddbb78188b376d69aeb8f0fa659b053fb7e18dc5c8600e37eb41aa6036d9d5f3d622464b19b0a16a950bae577bc594c4fbd0f0712ac736401c9c014273a6a3e1fb515ba49ef78475e729f72b92ae2092801902633a77d8ac2f84573452eb039578314309b4a5fadf60659ed24a1859627749053886b900aa80645c84a713cfe3c6c86f7fc36c40476c806ee8f8aec4354f"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000ff8c0)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {0x0, r11}, {}, {}, {}, {}, {r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r10}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r12}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r9}], 0x6, "37acc3a2f7f278"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00001008c0)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0xd8, "8bbfb425d625b4"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00001018c0)={0x3, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r22}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0xdc, "54fa205eb49572"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00001028c0)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000102ac0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000102cc0)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000102ec0)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r21}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0xe, "55bd7210c86ab6"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000103ec0)={0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00001040c0)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x5, "9ced7c4aaf2fa8"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00001050c0)={0xa, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r1}, {r2, r7}, {0x0, r13}, {r14, r15}, {0x0, r16}, {r17}, {r18, r19}, {0x0, r20}, {r23, r24}, {r25, r26}, {r27, r28}, {r29, r30}], 0x6, "1d98d91ec6e188"}) r31 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r31, 0x84, 0x76, &(0x7f0000000080)={0x0, 0xc}, &(0x7f00000000c0)=0x8) r32 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r32, 0x8933, &(0x7f0000000000)={'veth0_to_hsr\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000000)={0x1d, r33, 0x1, {0x0, 0x1, 0x1}, 0xfe}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000fe000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000003c040100000000002d400200000000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd99fb4d335ff00d15bc4630c993fffffe000000000000a236a791bcb6eff8d488041db6b8f2c158c2c3f4baacd0c8cc7eb1fd7fba93237e598771cf6f281aa72139"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 5.41468792s ago: executing program 1 (id=1114): unshare(0x2040400) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000180)=ANY=[], 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000002240), 0x2) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$nl_route(0x10, 0x3, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x42000, 0x10) r5 = syz_io_uring_setup(0xbdc, &(0x7f0000000080)={0x0, 0xec21, 0x80, 0x1, 0x373}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0x0, &(0x7f0000000100)=[{&(0x7f0000001800)=""/216, 0xd8}, {0x0}], 0x2, 0x0, 0x1}) io_uring_enter(r5, 0x847ba, 0x2000, 0xe, 0x0, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newtfilter={0x8ac, 0x2c, 0x800, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xa}, {}, {0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x87c, 0x2, [@TCA_ROUTE4_POLICE={0x868, 0x5, [@TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x4, 0x2, 0x8, 0x8, {0x5, 0x2, 0x9, 0x9, 0x31, 0x17}, {0x4, 0x0, 0x101, 0x2, 0x67, 0x3fc}, 0x3, 0x5}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x8b57, 0xc, 0x5, 0x3, 0x1, 0x8cc8, 0xffffffff, 0x7, 0x9, 0x8, 0x9, 0x5, 0x3, 0x10, 0x96d7, 0x2f, 0x5, 0x1, 0x4, 0x4, 0xdab, 0xffffffbf, 0x7, 0x1, 0xb2d, 0x7, 0x9, 0x1ff, 0x9, 0xfffffff7, 0x2, 0x3, 0x59e, 0x7fffffff, 0xfffffffc, 0x4, 0x4, 0xffff, 0x5, 0x1000, 0x2, 0x4, 0x3, 0x5, 0x2, 0x0, 0x8, 0x2, 0xb, 0x2, 0x2, 0x5, 0x0, 0x39c, 0x7f, 0x1, 0x98, 0x4748, 0x4ef6, 0x3, 0x6, 0x7f, 0x0, 0xb, 0x1ff, 0x1, 0x4, 0x1, 0x3, 0x81, 0x5, 0x7ff, 0x7ff, 0x0, 0x1, 0x800, 0x0, 0x9, 0x7, 0x5, 0x4, 0x3, 0x0, 0xffff, 0x134, 0x0, 0x9, 0x6, 0x6, 0x6, 0x4, 0x8, 0x9, 0x5, 0x6, 0x0, 0x1ff, 0x6, 0x9, 0xe, 0x8, 0x7, 0x8, 0x80000001, 0x5, 0x3, 0xfffffffe, 0x6, 0xad46, 0x3c5, 0x0, 0x20000000, 0x1ff, 0x80000000, 0xfffffff7, 0x3, 0x7, 0x0, 0x1ff, 0x0, 0x2, 0x8, 0x5, 0x9, 0x8, 0x2, 0x10000007, 0x0, 0x2, 0x5, 0x4, 0x9, 0x89, 0x4, 0x9, 0xe, 0x9fc, 0x8, 0x7, 0xbff, 0x1, 0xc, 0x9, 0x9, 0x8001, 0x8001, 0x9, 0x6, 0x8, 0x4, 0x8, 0x3, 0x8, 0xb2, 0xfffff800, 0x5, 0x0, 0xffff, 0x8c, 0x6, 0x3, 0x4, 0x5, 0x1, 0x15e, 0x8, 0x2, 0xfffffffc, 0x1000, 0x8, 0x400, 0x8, 0x6, 0x4, 0xa, 0xe, 0x100, 0x101, 0x0, 0x800, 0x7b, 0xe04, 0x3ff, 0xfffffffe, 0x9, 0x5ec, 0x6, 0xa, 0xfffffffd, 0xc7, 0xd, 0xfc, 0xfff, 0x0, 0x5, 0x5, 0x6, 0xe, 0x8, 0x7fff, 0x4, 0x10001, 0xfffffffd, 0x5, 0x3, 0xffff5545, 0x5, 0x3, 0x10, 0xfffffffe, 0x400, 0x6, 0x2, 0x1000, 0x1, 0x7fff, 0x8, 0x6, 0x40a2, 0x6, 0x27e9, 0x6, 0x80000000, 0x47, 0xfffffffc, 0x7fff, 0x1, 0xf4fa, 0x5, 0xffff, 0x4, 0x9, 0x8, 0xc, 0x5, 0x9, 0x3ff, 0xf, 0xd, 0x1, 0x7, 0x4, 0xfff, 0xe, 0x4, 0x5, 0x9, 0xfffffff8, 0xffffffff, 0xffff, 0xa13, 0xb, 0x80000001, 0x5, 0x767b63f]}, @TCA_POLICE_RATE={0x404, 0x2, [0x5b, 0x9adf, 0x0, 0x1, 0x9, 0x6, 0x1781, 0x5d, 0x6, 0x7, 0x72e4, 0xac, 0x9, 0x9, 0x2, 0x1, 0x1000, 0x3ff, 0x1, 0x5, 0x5, 0x1800000, 0x8, 0x5, 0x38000, 0xf10, 0x6, 0xfff, 0xb92a, 0x10, 0x4, 0xf, 0x4, 0x0, 0x80000000, 0xb4d4, 0x8, 0x0, 0x3ff, 0x0, 0x2, 0x9, 0x4, 0xfffffffa, 0x5, 0xa, 0xffff0001, 0x1000, 0xffff, 0xda, 0x0, 0x7f, 0x6, 0x1, 0x2, 0x7, 0x8, 0x9, 0x3ff, 0xc, 0x6, 0x2, 0x4, 0x5, 0x7, 0x7f, 0x0, 0x5, 0x200, 0x3, 0x3, 0x4, 0x630908e5, 0xfffffff3, 0x2c4e, 0x9, 0x0, 0x1, 0x1, 0xe3, 0x4, 0x19adac4d, 0x7f, 0x5, 0x50, 0x4, 0xfb, 0x3, 0x4, 0x6a, 0x100, 0x8000, 0x8, 0x6, 0xc8, 0x3, 0x3, 0x101, 0x10, 0x5, 0x6, 0x1, 0x0, 0x6, 0x3, 0x7, 0x7d0fd779, 0x1, 0x4, 0x19b7, 0xd, 0xfffffffd, 0x1, 0x1, 0x5, 0x1, 0x5, 0x3955a6de, 0x8000, 0x2, 0x9, 0x7ff, 0x5, 0x4, 0x3, 0x5, 0x5, 0x5d, 0x100, 0x4, 0xf, 0x90000000, 0xbf5, 0x3, 0x300000, 0x7, 0x5, 0x9, 0x4, 0xe80, 0x0, 0x5, 0x64, 0xfffffff1, 0x7fff, 0xcc0, 0x80000, 0x5afaf6c5, 0x0, 0x6, 0x7, 0x7, 0x6c000000, 0x10001, 0x8, 0x4, 0x5, 0x400, 0xe, 0x0, 0x5, 0x15, 0x1da, 0x0, 0x9, 0xd638, 0x7fffffff, 0x4c0, 0xbe9, 0x0, 0x8, 0x8, 0x3, 0x3, 0x6, 0x72c, 0xfffffffb, 0x10001, 0x10, 0x9, 0x1, 0x401, 0x5, 0x4, 0xffff, 0x7, 0x4, 0x54e, 0x1, 0x3dba, 0x40, 0x1ff, 0x2, 0x4, 0x3, 0x5, 0x3, 0x7f, 0x0, 0xdc6, 0xd, 0x7f, 0x5, 0x5, 0x1000, 0x6, 0x86f, 0x8001, 0x1, 0x8, 0x1ff, 0x81, 0x1, 0x6, 0x5, 0x7, 0x80000000, 0x9, 0x1, 0x6, 0x4, 0xffffffff, 0x80, 0xc, 0x8, 0xfffffffe, 0x9, 0x1, 0xd, 0x100, 0x1, 0xff, 0x1125, 0x7, 0x850, 0x7fffffff, 0x3edc, 0x10000, 0x10001, 0x2, 0x0, 0x40, 0x5, 0x5, 0x7, 0x7, 0xfff, 0x7, 0xe, 0xd0, 0x5, 0x101, 0x3, 0x2214, 0x4]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7f}, @TCA_POLICE_RESULT={0x8, 0x5, 0xffffffff}, @TCA_POLICE_RATE64={0xc, 0x8, 0x80000000}]}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0x10, 0x2}}]}}]}, 0x8ac}, 0x1, 0x0, 0x0, 0x22044028}, 0x800) 5.40509188s ago: executing program 2 (id=1115): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x141, 0x0, 0x4}, 0x18) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f00000002c0)={0x2}) mknod$loop(&(0x7f0000000200)='./file0\x00', 0x85c68e8ab9c77084, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0020001000010800004a00fcffff2b78fa7adf8e", @ANYRES32=0x0, @ANYBLOB="000000000420040014002b80080003001900000008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x3c}}, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) gettid() ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x0, 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000100000027bf000000050000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000ce9cbdaa4db4aeb85a68703a4b13b0966af637ec63a49b8fa431a770363f1ba45fb1d0768f705d2cc321e86e211b778ea92ea3c398351d2641a9482e626d31c4071810c5a95c3b87483fcb25a24565a5d688d8da35fb50cd2e6b17b5650801c513e80b7052e2f9fffd98db75066165a23bcf73548ab3761111072aa687a0e1b35af18f6c1e723e29d17670bad070e15682b16be2a6613d0466e0b1cd2141b801afadfdaf16c5c8c6733f6480dbf2cb4038984962d5d18efe5e0e1331a35a13c51e1cb6a2b89653fdef3b3263bfbd500f201a64c694195ccec55dafa45a595658ca4cf47a22db3c352e72dd32d772ca24a28079f412549af394ca949dcabd526bf78fce900aae1ab2751420d98abc526eec270000000000000000"], 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r2, 0x0) 5.388988422s ago: executing program 3 (id=1116): r0 = fsopen(&(0x7f00000003c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000280)='\xebU\x95\xa4i\xea`\xe0[\x9a\x84\x11\xc9&R:\xe9\xea\xec\xe05@b\x1f\xab\xb7\xe6\xd4\x18\xe7D@\xf5\xb2\xb4\xe8i$\x038\x99\xfb;\xbeR\xbf\xc2\r\x13\xf0\xf0\xec\x94\xad\nA\xee>\xb3i4\\\xc8\xd7 \x8d\xe0D\x953|) \xd8p\x12\x11\x81\x7f\x93\a\xfb!\x83\xc2\xd8\xe4\x98\xae\xb7\f\x0fR\xd3\xad\xa5\xca\xd5\xc2\bv+\x9a\x94\xd0\x05\x8d\xef\x9f94>\xa5?\x9a\x11Et\xef\xea\xe9e\x81\'jB\xca\f\xccz\x15x\x1cn\xe4\xf3\xbd\xb4q{\xb33\xffM\x95Jm\x90\x00\x15\r\xc8R\xb4\xf89>\xb7\x1e\xe3\x99\x99_~\xdb\xdc\xfd\x0f\x8f\xfc\xe4\xa4\xe8\x03K\xea\xb2\x91H|EB\xfd2\x10atXE\xee\xf4\x13c\xb5u\x85w$\xd3}\x19\xe7n\xf9\xe7\x11@\xceB\xd7/\xde\x80F\xe0\xd0dI\xedfq]\xb1\xaa\x9b)\\o\xd1\xdcx\x06\x80\x9f\xb3\xcc\r\b\xcb\xb1\x1c\x03G\xe4\xf0H`\x0e\xe1\xc7\x13\x9e%J\xe6\xe2\xe6\xb4:\xa8\xf51~\xc5\x8a\xfe++s\x0f\xa9\x00\x00A\xb8\xf1\xdb', &(0x7f00000000c0)="8c", 0xff57) 5.387811205s ago: executing program 4 (id=1117): r0 = socket$alg(0x26, 0x5, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000080)=0x7) bind$alg(r0, &(0x7f0000001100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x25b9, 0x100, 0x0, 0x215}, &(0x7f0000000040)=0x0, &(0x7f0000000400)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r6, 0x32, &(0x7f00000000c0)=@un=@abs={0x1, 0x0, 0x4e20}}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000540)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/17, 0x11}, {&(0x7f0000000200)=""/31, 0x1f}, {&(0x7f0000000300)=""/43, 0x2b}, {&(0x7f0000000440)=""/212, 0xd4}, {&(0x7f0000000340)=""/2, 0x2}], 0x6) io_uring_enter(r7, 0x3516, 0x483, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r10 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f7", 0x1}], 0x1}], 0x1, 0x40800) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/70, 0x46}], 0x1}, 0x0) 5.308631883s ago: executing program 3 (id=1118): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) getegid() bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000300)=0xffffffffffffffff, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xe) gettid() openat$userio(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x33, 0x8, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x74}}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000840)) pipe2$watch_queue(&(0x7f0000000880), 0x80) r3 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0xff06, 0x0) 5.113534425s ago: executing program 0 (id=1119): r0 = syz_usb_connect$uac1(0x2, 0x71, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000000206b1d010140000102030109025f0003010000000904000000010100"], 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x400, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x10}}, './file0\x00'}) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000800)={0xda, 0x1, 0x107360, 0x57e, 0x8, "acae425a0492f3efda33bf0b8597f9e7e18a49"}) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, 0x0, &(0x7f0000000780)={0x0, 0x3, 0x3f, @string={0x3f, 0x3, "0a882d8aba7a5141e94e87c1d95745928849ef068e91c78bc49285d1f6ee6627f13486484007125ac44ea017b4e002b3ef56e71d28a31e59c52bd89eb5"}}, 0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000001740), 0x3, 0x100400) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000001800)={0x1f, 0x3, &(0x7f0000001780)="1878d4"}) syz_usb_disconnect(r0) syz_usb_control_io$uac1(r0, &(0x7f0000000400)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x38, @string={0x38, 0x3, "6cbd87551224e3c8275120611eb137edc1efaa4436a252be915e9ccf0428ac904e71039a29ebe9624df68af5025c0b2c4fbe50f429dc"}}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000240)={0x14, &(0x7f00000000c0)=ANY=[@ANYBLOB="40317100000071024d1e5f0d8dab83da3b09199ad584552d79e20ed1043c4bc1c3bae7f9b5967ccfb78163466c9a044fb22d95cb79f199fd4b240d794a8981b8e23ea1adbea8b8be24f3ea1843e5d066a0dccee7265aaab2a36bcb81cc5efd35aa5fa0e7488eec1ba8bcfd97d41d123e39a6684a76dddc"], &(0x7f0000000140)={0x0, 0x3, 0xf6, @string={0xf6, 0x3, "728a61f7c66aae37aa140920df635a41dc5c4d78530e2ae84a7a47d4663c6b56bfe54c6b42c471cc4e9eadf1c4558559ecf0caeb7fab0289dbe1f349e8604f6f3b9809a4055fa1e95012b86e0e3295652df586446dd9ef381711e244bbbeb3fe03444c0e8d1c0701c4d3de6ee895b71cd5e136ff12f9ead01a1bbc810e8e80aa504917b76814034c423149557c817639b84d0714e0b1df2397eac134a7cb309909b53f636dd31babb7824519c316b6d389988ce0258eb215e86fce6f2769f1cb7fbead0873a6dbceeefaec316bfdb0e3088434f4a864fccf9f8c21d2aa35626f310b3e61d4ba4f9fae79dcadb5ea838a6c8318e5"}}}, &(0x7f0000000640)={0x44, &(0x7f00000004c0)={0x0, 0x18, 0xc7, "8d4bd9434cd450836dc752a5efe90cbca8882b2994d6c11360c222a81338a66a6ce112ef190675224ae1bc8a27a759be846da9a5e41a1d0be5a1b01c41b4de2c417cf772c589ce5872c4012824dbc8b332374b70700a904c0d997fb48f05dd22e8b7430dd63888124558f6e35b30cd35a39874e9b3148d185b2fdf15c8b19ed721fd614fa62e5fbb3912f4b2528844f86b0b60608b722bf800b793a65128d93daa15507b879308bd2ee9d2aab1249069959b04c79cae0b10fd0abcf0f9c26415e39c1ed31569e6"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x34}, &(0x7f0000000340)={0x20, 0x81, 0x3, "f0556a"}, &(0x7f00000003c0)={0x20, 0x82, 0x2, "73e3"}, &(0x7f0000000440)={0x20, 0x83, 0x1, "9c"}, &(0x7f0000000840)={0x20, 0x84, 0x4, "f00943ef"}, &(0x7f0000000600)={0x20, 0x85, 0x3, "6bee54"}}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f0000000700)=r4) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x56000}], 0x1) io_uring_enter(r5, 0x3557, 0x1c9a, 0x5, &(0x7f0000000080)={[0x3]}, 0x8) 4.478091356s ago: executing program 3 (id=1120): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', 0x0}) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2c0c2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x4, 0x8004, 0x0, 0xb49, 0x200000000001, 0x6, 0x8, 0x3}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed00000001090224000100000000090400000303000000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) close_range(r3, r3, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x4f, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x3695a90434db9d5e, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x1, 0x1, 0x40, 0x10, [{{0x9, 0x4, 0x0, 0x8, 0x3, 0x2, 0x6, 0x0, 0x7, {{0x7, 0x24, 0x6, 0x0, 0x0, "6ea1"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0xfffffffc, 0x3ff, 0xf8f7, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x9a, 0x69}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x7, 0x9, 0x10}}}}}]}}]}}, &(0x7f0000000a00)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) fchdir(0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000abc010000000a05000000000000000300010000000900010073797a3000000000d30006003407ae8929b5d5805c2cb15c6832bdf04f6f732bf6c75790a071b67033b0bb7e81aac8c9ccb093263d99fcafa58fe6c7126fc1d2ccbc1888abd4a61e1818723b358b147b8836997950921d849981687e7eb599e28bd439758eefcbda6f7906db339e68d3869e4011ddfb254a2dda9b523f928b3626f8faa75357d4f9cb925df5cde675f9e8bb05e4f8cc9a0610fb2945b1b755b94883afb3697a7535ea5f9db3ce21c1f0cc3fb343e830c6a947f512c56b1a706b86e76bc58a075f7cb0322f7fa6fb5df1718361423df5cbd47608ca000900010073797a310000000008000240000000030c000440000000000000000499000600db2b252f3c9b3b419bda841c524cb69270214a733fee6d8e10561ce9d682ad271b8a317d699b2f000178b2aca7c7058e0df489887ebdcf11c4ddf03bc9b1284f5fb568bac9b64b06c9d8c2acf08c892fb2abeb7c72bc9c8fa0c7425b5aa3df8074d8412d67fad836b6cc1c0be2fff19dbd1830e29ae4bc6aaa4f42c244e40238dc8e2a247b1792a177693b55dc155f631634db5af90000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000008000b40000000005c000480580001800b000100746172676574000048000280300003005fad843dc5c1efe84ced18d4422d5b0b86e8441958d3d2ea41149f1e55359af069a2a5e039ccf56f068a5a0b09000100534e41540000000008000240000000020900010073797a30"], 0x2a8}, 0x1, 0x0, 0x0, 0x84}, 0x0) 4.477094146s ago: executing program 4 (id=1121): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, 0x0, 0x0}) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000ac0)) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x1, r2}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f8ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0xfffffffe}, 0x10}, 0x94) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r7 = socket$inet6(0xa, 0x3, 0x3a) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}, 0x6}, 0x1c) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x4e22, 0xa, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r9 = fcntl$dupfd(r8, 0x0, r8) sendmsg$NL80211_CMD_SET_INTERFACE(r9, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f00000002c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x1) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f00000001c0)=0x8) read$FUSE(r3, &(0x7f0000003840)={0x2020}, 0xfffffffffffffc53) shutdown(r9, 0x0) recvmmsg(r8, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000000)=""/22, 0x16}], 0x1}, 0x4}], 0x1, 0x40002042, 0x0) connect$inet6(r7, &(0x7f0000000040), 0x1c) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, 0x0, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x0, 0x0, 0x0) dup3(r4, r5, 0x0) 3.824638623s ago: executing program 2 (id=1122): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x21800, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffd) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000200), 0x0, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r5, 0xc01464a6, &(0x7f0000000180)={r6}) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) keyctl$dh_compute(0x17, &(0x7f0000000380)={r2}, 0x0, 0x0, 0x0) socket(0x1d, 0x2, 0x6) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b1000905827931"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) 3.621812881s ago: executing program 4 (id=1123): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = semget$private(0x0, 0x20000000102, 0x0) semop(r0, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000040)=[0x807, 0x3, 0x9d]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) execve(0x0, 0x0, 0x0) sched_setattr(0xffffffffffffffff, &(0x7f0000000100)={0x38, 0x0, 0x40, 0x8, 0xab9, 0x75, 0x3, 0x348, 0x8, 0x3ff}, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x400080, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r3, 0x1, 0x53, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r6 = socket(0x10, 0x80002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mkdir(&(0x7f0000000180)='./file0/../file0/file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file4\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}, 0x1, 0x0, 0x0, 0x8811}, 0x8800) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xfff3}}}, 0x24}}, 0x0) 3.032633727s ago: executing program 0 (id=1124): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, 0x0, 0x0) set_mempolicy(0x8004, 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x101, 0x0, 0x3}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x9, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bind$alg(r4, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="69db2abd7000fcdbd7251000000076a557c07c61d71a1f6ce424f53dfd833836d53515d6a49c4ab1933a3ad0eb9a4d9e6513899a893a0c9501905fac6c0e7f59c148286d4148deacfcea596a964a87194e6e4082ed"], 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x4004880) r6 = accept4(r4, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) getsockname(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) sendmmsg$unix(r6, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) 1.327777495s ago: executing program 1 (id=1125): pipe2(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) vmsplice(r0, &(0x7f00000005c0)=[{&(0x7f0000001cc0)="b70cdbd771882612c450d694c9dd7d7f28d237e84e2780ca6428d132e03f188fff6bd9f85ead7e68f90830db9295022700491841f4a15a000aa4e29ac23601041ec521aa0ea8044f23feb74151693f228ba89f0a43385617bc7930f30a52ca91d02c64bd39d3d581abe9089b2284f876f9c58c124aba7a28700efcb0588ff4ab54a62c0c64fd577d85f5f753ec15281cf73fc37442b0a5ca4a1818cb01590d6415b1e9fda6c7d63cd293d7cc7ca5581041a2736e95b9b0322880b5fd7f27c0d4a59df8101b755fd6cc495963381c8a95d5d605b8ef4800b47091c8749f9e8e9fce163e46db0f7c0e4d0d3a621e3c999453e95aaa56090f220b220c50b31b9d6af722477ab1cda6d561156d85c658a3cd42d777314d154bf31bb61918ac7de8bfad7a5825be505af82806130e8dd03816b86086cc3361bf3a2a0cf6c18b7c84503477660ef5a0bf92d8169c43df1d7bb140652c799a4ac292b94fcea7f0c74413791879104e2bc9b414eda6c74f3625299f67d03e3ef58eeae5ca5fb029005ffa0fe23fb541bc24a57e9c6d8169702998273789ee8c9f08132ab9f76c02a6696c3ad68bf7a772d8be6b1840cfad2184edcf10bd5620f51657239e8eb49b8e77c1483dcc3dc04aeb6cae2922af4be346d52f2983dd5330cbef40b3207432ea6d2a6d2ffb0c3440c78add8395da089aa80e21d8692b16582edea583b73266fd1ab37abc02aa89310ed72a827153f1cbba0f76147a09977724706fdcd68ac168ceb433eba816f55bb5069924c0a6c59b1116e27de7938b835c467dbd9be1843913748e5a2e6f6621bf4944045d82b5124d23fa1d87e780b54a6955a51e47fbf36432be1b3d9d01c05d86e390e497856e476ce5b101c837cef62edce520860667c5259478602febbc5e87f216a6f1452b285f44282333569cbd2f49613730b86a74485e49e1979690ee2c11e1fb49d642c9f515d9e0cf30fe8995379b0b4b2177b2541a34cef72af676c2402b3ab03993047186d45016f83a735b7babda7b3e408f9a7b5c36e7daaaad51e437060c8a5a07646a31a43ebdda0b12a3f64f963315febebf0ad610f2ec9500717c4f33d8bf0e5b55ed2a976339643658df80f07bb29f5fac6f25957ef64ef1bac93f0ea64bfea48b38a4985ff610259762996044543bdf2c", 0x341}], 0x1, 0xa) fcntl$setpipe(r0, 0x407, 0x6) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000004c0)={r0, 0xffffffffffffffff, 0x32, 0x0, @val=@uprobe_multi={&(0x7f0000000400)='./file0\x00', &(0x7f0000000440), &(0x7f0000000480)=[0x4, 0x4, 0x3, 0x5], 0x400, 0x0, 0x1}}, 0x40) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000009c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010400000009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000380)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="4010090000009f04b42913d0e0c1d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000429bd7000fcdbdf25110000002000018014000200000000000000000000000000000000000800030001000000"], 0x34}, 0x1, 0x0, 0x0, 0xc894}, 0xc0) r3 = open(&(0x7f0000000140)='./file0\x00', 0x10900, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmmsg$inet6(r6, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="5e60e574da93883e8c628a600b17cbe584d2e73c681419", 0x17}], 0x1}}], 0x1, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r4, 0x80189439, &(0x7f00000003c0)) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="ec000000ca3848c24b4a7d32640c8793ce1589c320b39a5fee46d168bc40d0086927aed47e913a1b2cc3ffb73e56c9592955cf96740d8c5d6038244548f15dd09b41ea0024697394953df387109cfbffffff1ae10c7900f04a64b643855e3b8c8d6b29207b2349248690d4d684cd6a402f193a89765371fa202fb35989f085062a88a64b32ff55ceb4740ae6d96982e8f3000e0035bd772da7f5901fcd86477b8316aa5ab1b350f22fa75667207af71678eaeae9ceffdcedd04e8f", @ANYRES8=r3, @ANYRES8=r7], 0xec}, 0x1, 0x0, 0x0, 0x44081}, 0x80) bind$inet6(0xffffffffffffffff, &(0x7f0000000380)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0xe67}, 0x1c) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05"], 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x40044591, 0x0) writev(0xffffffffffffffff, &(0x7f0000000f40)=[{&(0x7f0000000c40)="e39b7d4ed2e7cf6d3ff5500217062178cee1f16f6f01f383", 0x18}], 0x1) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) 913.714226ms ago: executing program 3 (id=1126): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000040)={0x10000, 0x240, 0x0, 0x0}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 599.829665ms ago: executing program 0 (id=1127): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x5c, 0x0, 0x1, 0x101, 0x0, 0x0, {0x1}, [@CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xe, 0x1, 'irc-20000\x00'}}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x6}, @CTA_LABELS={0x24, 0x16, 0x1, 0x0, [0x5, 0x0, 0x8, 0x7, 0x2, 0x4, 0x24, 0x3]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004800}, 0x20480d0) r2 = socket$key(0xf, 0x3, 0x2) recvmmsg(r2, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x800, 0x0, 0x103, 0x1, 0x3}, 0x20) getsockopt$IP_SET_OP_VERSION(r3, 0x1, 0x53, &(0x7f0000000040), &(0x7f0000000080)=0x8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000010c0)=@newqdisc={0x50, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x84, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x1f}, @TCA_FQ_PLIMIT={0x8, 0x1, 0x9}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x2, 0x5}, @TCA_FQ_TIMER_SLACK={0x8, 0xd, 0xff}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 471.993553ms ago: executing program 3 (id=1128): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = fsopen(&(0x7f00000003c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x2, &(0x7f0000000280)='\xebU\x95\xa4i\xea`\xe0[\x9a\x84\x11\xc9&R:\xe9\xea\xec\xe05@b\x1f\xab\xb7\xe6\xd4\x18\xe7D@\xf5\xb2\xb4\xe8i$\x038\x99\xfb;\xbeR\xbf\xc2\r\x13\xf0\xf0\xec\x94\xad\nA\xee>\xb3i4\\\xc8\xd7 \x8d\xe0D\x953|) \xd8p\x12\x11\x81\x7f\x93\a\xfb!\x83\xc2\xd8\xe4\x98\xae\xb7\f\x0fR\xd3\xad\xa5\xca\xd5\xc2\bv+\x9a\x94\xd0\x05\x8d\xef\x9f94>\xa5?\x9a\x11Et\xef\xea\xe9e\x81\'jB\xca\f\xccz\x15x\x1cn\xe4\xf3\xbd\xb4q{\xb33\xffM\x95Jm\x90\x00\x15\r\xc8R\xb4\xf89>\xb7\x1e\xe3\x99\x99_~\xdb\xdc\xfd\x0f\x8f\xfc\xe4\xa4\xe8\x03K\xea\xb2\x91H|EB\xfd2\x10atXE\xee\xf4\x13c\xb5u\x85w$\xd3}\x19\xe7n\xf9\xe7\x11@\xceB\xd7/\xde\x80F\xe0\xd0dI\xedfq]\xb1\xaa\x9b)\\o\xd1\xdcx\x06\x80\x9f\xb3\xcc\r\b\xcb\xb1\x1c\x03G\xe4\xf0H`\x0e\xe1\xc7\x13\x9e%J\xe6\xe2\xe6\xb4:\xa8\xf51~\xc5\x8a\xfe++s\x0f\xa9\x00\x00A\xb8\xf1\xdb', &(0x7f00000000c0)="8c", 0xff57) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r4) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r5 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f0000000140)={0x100, r6}, 0x0) openat2(r4, &(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)={0x10100, 0x1, 0x20}, 0x18) landlock_restrict_self(r5, 0x0) shmctl$IPC_RMID(0x0, 0x0) r7 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@rand_addr=0x64010101, @in=@private=0xa010182, 0x4e23, 0x8, 0x4e22, 0x20, 0xa, 0x0, 0x80, 0x3c}, {0x0, 0x5, 0x31, 0x200, 0xb801, 0xa6f, 0x3, 0x2a}, {0x81, 0x390b8798, 0x3, 0xdca7}, 0xfffffffe, 0x10, 0x2, 0x0, 0x1, 0x3}, {{@in6=@private0, 0x4d5, 0x2b}, 0x2, @in6=@empty, 0x3505, 0x4, 0x520f297193e84447, 0x2, 0x8d1, 0x73b4, 0x417c5be3}}, 0xe8) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1\x00', 0x81c0, 0x0) socket(0x400000000010, 0x3, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r8, 0x5414, &(0x7f0000000340)={0x4, 0x1, 0x9, 0x3}) 265.599603ms ago: executing program 0 (id=1129): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea00090587033b"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd01000000000014"], 0xfdef) syz_open_dev$video(&(0x7f0000000b00), 0x3, 0x140) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000), &(0x7f0000000040)={0x0, 0xfb, 0x4e, 0x2, 0xc, "acd6d3c9251e91626fd8b8852ca47aae", "fa635bdb08b31f0956822d85538b43c4f2b08922a6f35245a21afa04f7d23d3b58e17f0fc0142a254d819f702f6d9f9ee2e4643a3b9d7d72b5"}, 0x4e, 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000240)={0x40, 0x10, 0x6, "3f31e576ce89"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGMASK(r4, 0x5b03, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)={0x40, 0x22, 0xa2, {0xa2, 0x23, "bd6af05616d37b8ef04a8f09534bba015ab52ab60181c3f8e38f4598ab691e77e6c3f562f0349c639f6b40fcfca222f475b152fcd600d9feef2675e46f4ca6f7d4cd2d9e63424203ce78b684a1ee74109be0713e3a5b994bb6f22da90be75befa67f4731d4c7e3f96cadd253ecfd0db8a24571e397b52c0040bcb8ed6f6f01df3414dfc6a660fcf496ffa248ae96f6f0510ce10de62bc86783a055036fbf4cfb"}}, &(0x7f0000000340)={0x0, 0x3, 0xb, @string={0xb, 0x3, "3c408404083725ae9c"}}, &(0x7f0000000380)={0x0, 0xf, 0x13, {0x5, 0xf, 0x13, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0xe, 0x6, 0x7, 0x85}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x4, 0x0, 0x2}]}}, &(0x7f0000000400)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7e, 0x10, 0x80, 0x40, "88e42d6e", "f3ef3398"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x4, 0x32, 0x0, 0x2f, 0x244, 0x7fff}}}, &(0x7f0000000a40)={0x84, &(0x7f0000000500)={0x20, 0x12, 0x30, "9ce6b15d10162e81de601689d749f46bdef1e7eadfe7ff070686ade032f0f9fdfedbf71156f5af29af3d01e6f61b6187"}, &(0x7f0000000600)={0x0, 0xa, 0x1}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x35}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x1, 0x20}}, &(0x7f0000000740)={0x40, 0x7, 0x2, 0xfff8}, &(0x7f00000007c0)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000800)={0x40, 0xb, 0x2, "20d7"}, &(0x7f0000000840)={0x40, 0xf, 0x2, 0x9ff}, &(0x7f0000000880)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000008c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000900)={0x40, 0x19, 0x2, "3711"}, &(0x7f0000000940)={0x40, 0x1a, 0x2, 0x2}, &(0x7f0000000980)={0x40, 0x1c, 0x1, 0x6}, &(0x7f00000009c0)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000a00)={0x40, 0x21, 0x1, 0x8}}) write$char_usb(r1, &(0x7f0000001300)='7', 0x1) 0s ago: executing program 4 (id=1130): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) getegid() bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000300)=0xffffffffffffffff, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xe) gettid() openat$userio(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)={{0x14}, [@NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x33, 0x8, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x74}}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000840)) pipe2$watch_queue(&(0x7f0000000880), 0x80) r3 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0xff06, 0x0) kernel console output (not intermixed with test programs): 303.678731][ T24] usb 4-1: SerialNumber: syz [ 303.692443][ T24] usb 4-1: config 0 descriptor?? [ 303.704841][ T24] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 303.714987][ T24] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input30 [ 303.725386][ T919] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 303.889741][ T919] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 303.898373][ T5918] usb 5-1: USB disconnect, device number 36 [ 303.924373][ T919] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 303.954362][ T919] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 303.954406][ T919] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 303.954484][ T919] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 303.954506][ T919] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 303.954527][ T919] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 303.973771][ T919] usb 2-1: string descriptor 0 read error: -22 [ 303.973934][ T919] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 303.973957][ T919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.977543][ T919] usb 2-1: config 0 descriptor?? [ 303.979995][ T919] hub 2-1:0.0: bad descriptor, ignoring hub [ 303.980011][ T919] hub 2-1:0.0: probe with driver hub failed with error -5 [ 304.016470][ T919] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input31 [ 304.298233][ T5985] usb 2-1: USB disconnect, device number 34 [ 304.757682][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 304.765465][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 304.772605][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 304.779903][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 304.787034][ T919] usb 4-1: USB disconnect, device number 35 [ 304.792985][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 304.792999][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 304.818755][ T919] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 304.963655][ T5925] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 305.059578][ T919] usb 3-1: USB disconnect, device number 44 [ 305.123651][ T5925] usb 5-1: Using ep0 maxpacket: 32 [ 305.131295][ T5925] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 305.141009][ T5925] usb 5-1: config 0 has no interface number 0 [ 305.147977][ T5925] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 305.164476][ T5925] usb 5-1: config 0 interface 85 has no altsetting 0 [ 305.177182][ T5925] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 305.187622][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.197836][ T5925] usb 5-1: Product: syz [ 305.202139][ T5925] usb 5-1: Manufacturer: syz [ 305.209508][ T5925] usb 5-1: SerialNumber: syz [ 305.218725][ T5925] usb 5-1: config 0 descriptor?? [ 305.337323][ T5985] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 305.576327][ T5984] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 305.617547][ T5985] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 305.629411][ T5985] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 305.675511][ T5985] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 305.685693][ T5985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 305.864532][ T5925] appletouch 5-1:0.85: Geyser mode initialized. [ 305.883835][ T58] gspca_sonixj: i2c_w8 err -110 [ 305.906983][ T58] sonixj 1-1:0.0: probe with driver sonixj failed with error -110 [ 305.946015][ T5984] usb 3-1: Using ep0 maxpacket: 8 [ 305.960455][ T5925] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input32 [ 305.970347][ T5985] usb 2-1: SerialNumber: syz [ 306.003437][ T5984] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 306.032404][ T5984] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 306.041825][ T5984] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.051338][ T5984] usb 3-1: Product: syz [ 306.055766][ T5984] usb 3-1: Manufacturer: syz [ 306.060421][ T5984] usb 3-1: SerialNumber: syz [ 306.084419][ T5925] usb 5-1: USB disconnect, device number 37 [ 306.090356][ C0] appletouch 5-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 306.119545][ T5984] usb 3-1: config 0 descriptor?? [ 306.138684][ T5984] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 306.177999][ T5984] usb 3-1: setting power ON [ 306.205565][ T5984] dvb-usb: bulk message failed: -22 (2/0) [ 306.227718][ T5984] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 306.266264][ T5984] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 306.434753][ T5925] appletouch 5-1:0.85: input: appletouch disconnected [ 306.451000][ T8862] dvb-usb: bulk message failed: -22 (3/0) [ 306.457866][ T8862] dvb-usb: bulk message failed: -22 (3/0) [ 306.569616][ T5984] usb 3-1: media controller created [ 306.783240][ T5984] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 306.787272][ T8877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 306.868069][ T8877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 306.942936][ T8877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.033920][ T5984] usb 3-1: selecting invalid altsetting 6 [ 307.073817][ T5984] usb 3-1: digital interface selection failed (-22) [ 307.112183][ T5984] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 307.201034][ T5984] usb 3-1: setting power OFF [ 307.205801][ T5984] dvb-usb: bulk message failed: -22 (2/0) [ 307.211733][ T5984] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 307.231720][ T5984] (NULL device *): no alternate interface [ 307.426742][ T58] usb 1-1: USB disconnect, device number 44 [ 307.650265][ T8886] netlink: 'syz.3.789': attribute type 1 has an invalid length. [ 307.840744][ T8888] netlink: 28 bytes leftover after parsing attributes in process `syz.3.789'. [ 308.083615][ T58] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 308.424079][ T5985] usb 2-1: 0:2 : does not exist [ 308.432274][ T58] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 308.441418][ T58] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.483641][ T5985] usb 2-1: unit 5: unexpected type 0x09 [ 308.768799][ T58] usb 1-1: config 0 descriptor?? [ 308.836909][ T5984] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 308.867264][ T8902] netlink: 4 bytes leftover after parsing attributes in process `syz.1.792'. [ 308.901867][ T5985] usb 2-1: USB disconnect, device number 35 [ 308.941168][ T5984] usb 3-1: USB disconnect, device number 45 [ 309.003155][ T8902] bridge_slave_1: left allmulticast mode [ 309.032951][ T8902] bridge_slave_1: left promiscuous mode [ 309.089505][ T8902] bridge0: port 2(bridge_slave_1) entered disabled state [ 309.120562][ T8522] udevd[8522]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 309.211081][ T8902] bridge_slave_0: left allmulticast mode [ 309.222426][ T8902] bridge_slave_0: left promiscuous mode [ 309.234578][ T8902] bridge0: port 1(bridge_slave_0) entered disabled state [ 309.430570][ T5984] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 309.567322][ T8914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.797'. [ 309.680067][ T5984] usb 3-1: config 0 has no interfaces? [ 309.685757][ T5984] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 309.702703][ T5984] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.735351][ T8918] netlink: 4 bytes leftover after parsing attributes in process `syz.4.796'. [ 309.923297][ T58] pegasus 1-1:0.0: probe with driver pegasus failed with error -32 [ 309.991465][ T5984] usb 3-1: config 0 descriptor?? [ 310.220624][ T8903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.274452][ T8903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.289653][ T8922] erspan0: entered promiscuous mode [ 310.298010][ T8922] batman_adv: batadv0: Adding interface: macvlan2 [ 310.306086][ T8903] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 310.316236][ T8922] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 310.365743][ T8922] batman_adv: batadv0: Interface activated: macvlan2 [ 310.389914][ T5984] usb 3-1: USB disconnect, device number 46 [ 310.663711][ T5985] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 310.803776][ T5985] usb 4-1: device descriptor read/64, error -71 [ 310.948461][ T30] audit: type=1326 audit(1759109706.580:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.043832][ T5985] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 311.143788][ T30] audit: type=1326 audit(1759109706.580:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.223739][ T5985] usb 4-1: device descriptor read/64, error -71 [ 311.249918][ T30] audit: type=1326 audit(1759109706.580:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.284280][ T8930] input: syz1 as /devices/virtual/input/input33 [ 311.334219][ T5985] usb usb4-port1: attempt power cycle [ 311.404165][ T30] audit: type=1326 audit(1759109706.580:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.447578][ T30] audit: type=1326 audit(1759109706.580:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.499909][ T30] audit: type=1326 audit(1759109706.610:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.526532][ T30] audit: type=1326 audit(1759109706.620:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.553897][ T30] audit: type=1326 audit(1759109706.620:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.641963][ T5918] usb 1-1: USB disconnect, device number 45 [ 311.678816][ T30] audit: type=1326 audit(1759109706.630:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.706989][ T30] audit: type=1326 audit(1759109706.630:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.2.801" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e3e98eec9 code=0x7ffc0000 [ 311.737815][ T5985] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 311.779463][ T5985] usb 4-1: device descriptor read/8, error -71 [ 312.064075][ T5985] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 312.099478][ T5985] usb 4-1: device descriptor read/8, error -71 [ 312.214019][ T5985] usb usb4-port1: unable to enumerate USB device [ 312.766053][ T8937] QAT: failed to copy from user. [ 313.193888][ T5918] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 313.356545][ T5918] usb 5-1: Using ep0 maxpacket: 32 [ 313.372101][ T5918] usb 5-1: config 2 has an invalid interface number: 45 but max is 0 [ 313.387200][ T5918] usb 5-1: config 2 has no interface number 0 [ 313.393314][ T5918] usb 5-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 313.412255][ T5918] usb 5-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 313.451159][ T5918] usb 5-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 313.464321][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.482522][ T5918] usb 5-1: Product: syz [ 313.483743][ T5985] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 313.499085][ T5918] usb 5-1: Manufacturer: syz [ 313.511337][ T5918] usb 5-1: SerialNumber: syz [ 313.538911][ T5918] kobil_sct 5-1:2.45: KOBIL USB smart card terminal converter detected [ 313.554713][ T8958] netlink: 48 bytes leftover after parsing attributes in process `syz.0.812'. [ 313.557442][ T5918] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 313.655782][ T8960] FAULT_INJECTION: forcing a failure. [ 313.655782][ T8960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.669324][ T8960] CPU: 1 UID: 0 PID: 8960 Comm: syz.2.813 Not tainted syzkaller #0 PREEMPT(full) [ 313.669355][ T8960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 313.669365][ T8960] Call Trace: [ 313.669372][ T8960] [ 313.669380][ T8960] dump_stack_lvl+0x189/0x250 [ 313.669405][ T8960] ? __pfx____ratelimit+0x10/0x10 [ 313.669424][ T8960] ? __pfx_dump_stack_lvl+0x10/0x10 [ 313.669444][ T8960] ? __pfx__printk+0x10/0x10 [ 313.669466][ T8960] ? __might_fault+0xb0/0x130 [ 313.669501][ T8960] should_fail_ex+0x414/0x560 [ 313.669530][ T8960] _copy_from_user+0x2d/0xb0 [ 313.669553][ T8960] snd_seq_ioctl+0x1d8/0x420 [ 313.669584][ T8960] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 313.669626][ T8960] ? __fget_files+0x3a0/0x420 [ 313.669642][ T8960] ? __fget_files+0x2a/0x420 [ 313.669661][ T8960] ? bpf_lsm_file_ioctl+0x9/0x20 [ 313.669681][ T8960] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 313.669705][ T8960] __se_sys_ioctl+0xfc/0x170 [ 313.669728][ T8960] do_syscall_64+0xfa/0x3b0 [ 313.669747][ T8960] ? lockdep_hardirqs_on+0x9c/0x150 [ 313.669764][ T8960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.669781][ T8960] ? clear_bhb_loop+0x60/0xb0 [ 313.669802][ T8960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.669817][ T8960] RIP: 0033:0x7f1e3e98eec9 [ 313.669833][ T8960] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 313.669848][ T8960] RSP: 002b:00007f1e3f816038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 313.669866][ T8960] RAX: ffffffffffffffda RBX: 00007f1e3ebe5fa0 RCX: 00007f1e3e98eec9 [ 313.669879][ T8960] RDX: 0000200000000080 RSI: 00000000c058534f RDI: 0000000000000004 [ 313.669891][ T8960] RBP: 00007f1e3f816090 R08: 0000000000000000 R09: 0000000000000000 [ 313.669902][ T8960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.669912][ T8960] R13: 00007f1e3ebe6038 R14: 00007f1e3ebe5fa0 R15: 00007f1e3ed0fa28 [ 313.669941][ T8960] [ 313.765650][ T5985] usb 4-1: Using ep0 maxpacket: 32 [ 313.916116][ T8942] netlink: 72 bytes leftover after parsing attributes in process `syz.4.806'. [ 313.957049][ T5985] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 313.968125][ T5985] usb 4-1: config 0 has no interface number 0 [ 313.975569][ T5985] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 314.019723][ T5985] usb 4-1: config 0 interface 85 has no altsetting 0 [ 314.021329][ T8968] netlink: 'syz.0.815': attribute type 1 has an invalid length. [ 314.062274][ T5985] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 314.074307][ T5985] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.088246][ T5985] usb 4-1: Product: syz [ 314.094681][ T5985] usb 4-1: Manufacturer: syz [ 314.101806][ T5985] usb 4-1: SerialNumber: syz [ 314.110880][ T5985] usb 4-1: config 0 descriptor?? [ 314.130874][ T8972] bond7: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 314.289971][ T59] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 314.308415][ T8968] 8021q: adding VLAN 0 to HW filter on device bond7 [ 314.323153][ T58] usb 5-1: USB disconnect, device number 38 [ 314.340905][ T58] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 314.379774][ T58] kobil_sct 5-1:2.45: device disconnected [ 314.472534][ T8968] bond7 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 314.482389][ T8968] bond7 (unregistering): (slave ip6gretap1): Releasing backup interface [ 314.493453][ T8968] bond7 (unregistering): Released all slaves [ 314.503826][ T919] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 314.609754][ T8977] netlink: 100 bytes leftover after parsing attributes in process `syz.0.817'. [ 314.627641][ T8977] ip6gre1: entered allmulticast mode [ 314.675950][ T919] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.686811][ T919] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 314.702270][ T919] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 314.722150][ T919] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 314.725489][ T5985] appletouch 4-1:0.85: Geyser mode initialized. [ 314.750770][ T919] usb 2-1: Manufacturer: syz [ 314.753994][ T5985] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input34 [ 314.777112][ T919] usb 2-1: config 0 descriptor?? [ 314.812485][ T919] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 314.950762][ T5953] usb 4-1: USB disconnect, device number 40 [ 314.950812][ C1] appletouch 4-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 315.031800][ T5953] appletouch 4-1:0.85: input: appletouch disconnected [ 315.051558][ T8986] usb usb8: usbfs: process 8986 (syz.4.820) did not claim interface 0 before use [ 315.453765][ T5984] usb 1-1: new low-speed USB device number 46 using dummy_hcd [ 315.598900][ T5984] usb 1-1: device descriptor read/64, error -71 [ 315.936358][ T919] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 316.089883][ T5984] usb 1-1: new low-speed USB device number 47 using dummy_hcd [ 316.129085][ T919] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 316.144983][ T919] usb 3-1: config 1 has no interface number 0 [ 316.159389][ T919] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 316.186944][ T919] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 8 [ 316.209999][ T919] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 16 [ 316.223681][ T5984] usb 1-1: device descriptor read/64, error -71 [ 316.349613][ T919] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 316.367447][ T5984] usb usb1-port1: attempt power cycle [ 316.422472][ T919] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 316.431886][ T919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.440494][ T919] usb 3-1: Product: syz [ 316.445703][ T919] usb 3-1: Manufacturer: syz [ 316.521537][ T919] usb 3-1: SerialNumber: syz [ 316.535447][ T9002] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 316.542779][ T9002] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 316.769019][ T919] usb 3-1: Error in usbnet_get_endpoints (-71) [ 316.794619][ T5984] usb 1-1: new low-speed USB device number 48 using dummy_hcd [ 316.821296][ T919] usb 3-1: USB disconnect, device number 47 [ 316.824527][ T5984] usb 1-1: device descriptor read/8, error -71 [ 317.074237][ T5984] usb 1-1: new low-speed USB device number 49 using dummy_hcd [ 317.091521][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.098033][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.127264][ T5984] usb 1-1: device descriptor read/8, error -71 [ 317.232930][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.242561][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.252048][ T5984] usb usb1-port1: unable to enumerate USB device [ 317.261988][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.270887][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.279854][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.289629][ T9018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.291549][ T9019] netlink: 20 bytes leftover after parsing attributes in process `syz.3.827'. [ 317.327397][ T5984] usb 2-1: USB disconnect, device number 36 [ 317.374772][ T919] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 317.573688][ T919] usb 5-1: Using ep0 maxpacket: 32 [ 317.581770][ T919] usb 5-1: config 0 has an invalid interface number: 247 but max is 0 [ 317.623093][ T919] usb 5-1: config 0 has no interface number 0 [ 317.626110][ T919] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 317.626134][ T919] usb 5-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 317.626145][ T919] usb 5-1: Product: syz [ 317.626153][ T919] usb 5-1: Manufacturer: syz [ 317.630208][ T919] usb 5-1: config 0 descriptor?? [ 317.700416][ T58] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 317.707187][ T9027] netlink: 'syz.1.829': attribute type 5 has an invalid length. [ 317.844626][ T9017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.854881][ T9017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.943549][ T58] usb 3-1: Using ep0 maxpacket: 32 [ 317.951218][ T58] usb 3-1: config 2 has an invalid interface number: 45 but max is 0 [ 317.961861][ T58] usb 3-1: config 2 has no interface number 0 [ 317.968185][ T58] usb 3-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 317.979339][ T58] usb 3-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 318.005158][ T58] usb 3-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 318.021517][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.038831][ T58] usb 3-1: Product: syz [ 318.047500][ T58] usb 3-1: Manufacturer: syz [ 318.058650][ T58] usb 3-1: SerialNumber: syz [ 318.103060][ T58] kobil_sct 3-1:2.45: KOBIL USB smart card terminal converter detected [ 318.139152][ T58] usb 3-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 318.412747][ T5925] usb 3-1: USB disconnect, device number 48 [ 318.421825][ T5925] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 318.434089][ T5925] kobil_sct 3-1:2.45: device disconnected [ 318.455688][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 318.455701][ T30] audit: type=1326 audit(1759109714.090:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.503589][ T30] audit: type=1326 audit(1759109714.090:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faf30f8d710 code=0x7ffc0000 [ 318.536711][ T30] audit: type=1326 audit(1759109714.090:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.559497][ T30] audit: type=1326 audit(1759109714.090:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.606135][ T30] audit: type=1326 audit(1759109714.090:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.649554][ T30] audit: type=1326 audit(1759109714.090:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.671702][ C0] vkms_vblank_simulate: vblank timer overrun [ 318.689936][ T30] audit: type=1326 audit(1759109714.090:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.716577][ T30] audit: type=1326 audit(1759109714.090:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.738626][ C0] vkms_vblank_simulate: vblank timer overrun [ 318.745866][ T30] audit: type=1326 audit(1759109714.090:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.768444][ T30] audit: type=1326 audit(1759109714.090:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9041 comm="syz.3.835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf30f8eec9 code=0x7ffc0000 [ 318.790648][ C0] vkms_vblank_simulate: vblank timer overrun [ 319.053685][ T5925] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 319.223605][ T5925] usb 1-1: Using ep0 maxpacket: 8 [ 319.240805][ T5925] usb 1-1: config index 0 descriptor too short (expected 2834, got 18) [ 319.256461][ T5925] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 319.265647][ T5953] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 319.283629][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.292249][ T5925] usb 1-1: Product: syz [ 319.297478][ T5925] usb 1-1: Manufacturer: syz [ 319.302083][ T5925] usb 1-1: SerialNumber: syz [ 319.320379][ T5925] usb 1-1: config 0 descriptor?? [ 319.473605][ T5953] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 319.492922][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.503938][ T5953] usb 3-1: Product: syz [ 319.508232][ T5953] usb 3-1: Manufacturer: syz [ 319.512939][ T5953] usb 3-1: SerialNumber: syz [ 319.531435][ T5953] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 319.539556][ T58] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 319.562049][ T5925] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 319.573342][ T5984] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 319.756498][ T9044] support for cryptoloop has been removed. Use dm-crypt instead. [ 320.008715][ T9050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.039305][ T9050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.051026][ C0] usb 3-1: ath9k_htc: over RX MAX_PKT_NUM [ 320.188147][ T9] usb 5-1: USB disconnect, device number 39 [ 320.252640][ T9050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.276237][ T9050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.330257][ T5925] gspca_sunplus: reg_w_riv err -110 [ 320.342918][ T5953] usb 3-1: USB disconnect, device number 49 [ 320.355885][ T5925] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 320.935983][ T5984] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 320.936835][ T5984] ath9k_htc: Failed to initialize the device [ 321.023535][ T5953] usb 3-1: ath9k_htc: USB layer deinitialized [ 321.589595][ T9079] syzkaller0: entered promiscuous mode [ 321.628754][ T9079] syzkaller0: entered allmulticast mode [ 321.746450][ T58] usb 1-1: USB disconnect, device number 50 [ 322.223565][ T5984] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 322.233870][ T58] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 322.395282][ T5952] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 322.473541][ T5984] usb 2-1: Using ep0 maxpacket: 32 [ 322.480298][ T5984] usb 2-1: config 2 has an invalid interface number: 45 but max is 0 [ 322.489021][ T5984] usb 2-1: config 2 has no interface number 0 [ 322.495801][ T5984] usb 2-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 322.511295][ T5984] usb 2-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 322.529919][ T5984] usb 2-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 322.539876][ T5984] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.548542][ T5984] usb 2-1: Product: syz [ 322.552995][ T5984] usb 2-1: Manufacturer: syz [ 322.558340][ T5984] usb 2-1: SerialNumber: syz [ 322.563727][ T58] usb 4-1: device descriptor read/64, error -71 [ 322.577085][ T5984] kobil_sct 2-1:2.45: KOBIL USB smart card terminal converter detected [ 322.591291][ T5984] usb 2-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 322.593650][ T5952] usb 1-1: Using ep0 maxpacket: 8 [ 322.675107][ T5952] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 322.687685][ T5952] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 322.711357][ T5952] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 322.723939][ T5952] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 322.741114][ T5952] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 322.750261][ T5952] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.804582][ T9085] __nla_validate_parse: 48 callbacks suppressed [ 322.804594][ T9085] netlink: 72 bytes leftover after parsing attributes in process `syz.1.849'. [ 322.823007][ T58] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 323.004154][ T58] usb 4-1: device descriptor read/64, error -71 [ 323.117636][ T58] usb usb4-port1: attempt power cycle [ 323.124410][ T5952] usb 1-1: GET_CAPABILITIES returned 0 [ 323.129986][ T5952] usbtmc 1-1:16.0: can't read capabilities [ 323.159680][ T24] usb 2-1: USB disconnect, device number 38 [ 323.183012][ T24] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 323.212840][ T24] kobil_sct 2-1:2.45: device disconnected [ 323.339427][ T5984] usb 1-1: USB disconnect, device number 51 [ 323.484573][ T58] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 323.524623][ T58] usb 4-1: device descriptor read/8, error -71 [ 323.543562][ T5952] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 323.713855][ T5952] usb 5-1: Using ep0 maxpacket: 8 [ 323.763635][ T58] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 323.787209][ T5952] usb 5-1: config 0 has an invalid interface number: 63 but max is 0 [ 323.796595][ T5952] usb 5-1: config 0 has no interface number 0 [ 323.802711][ T5952] usb 5-1: config 0 interface 63 altsetting 119 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 323.820087][ T58] usb 4-1: device descriptor read/8, error -71 [ 323.837874][ T5952] usb 5-1: config 0 interface 63 has no altsetting 0 [ 323.884368][ T5952] usb 5-1: New USB device found, idVendor=046d, idProduct=0896, bcdDevice=3a.11 [ 323.910796][ T5952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.951693][ T5952] usb 5-1: Product: syz [ 323.956422][ T58] usb usb4-port1: unable to enumerate USB device [ 323.994873][ T5952] usb 5-1: Manufacturer: syz [ 324.014418][ T5952] usb 5-1: SerialNumber: syz [ 324.045627][ T5952] usb 5-1: config 0 descriptor?? [ 324.067993][ T5952] gspca_main: vc032x-2.14.0 probing 046d:0896 [ 324.309268][ T9110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.337848][ T9110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.698821][ T5952] gspca_vc032x: reg_r err -110 [ 324.713900][ T5952] vc032x 5-1:0.63: probe with driver vc032x failed with error -110 [ 324.773762][ T24] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 324.882085][ T9144] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 324.930794][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 324.944616][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 324.954951][ T24] usb 3-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 324.964824][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.976715][ T24] usb 3-1: config 0 descriptor?? [ 325.424732][ T24] hid-led 0003:0FC5:B080.0004: probe with driver hid-led failed with error -71 [ 325.472787][ T24] usb 3-1: USB disconnect, device number 50 [ 326.046440][ T9167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.868'. [ 326.233558][ T24] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 326.525891][ T5925] usb 5-1: USB disconnect, device number 40 [ 326.593828][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 326.605904][ T24] usb 4-1: config 2 has an invalid interface number: 45 but max is 0 [ 326.614181][ T24] usb 4-1: config 2 has no interface number 0 [ 326.622011][ T24] usb 4-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 326.643161][ T24] usb 4-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 326.672006][ T24] usb 4-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 326.690072][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.698731][ T24] usb 4-1: Product: syz [ 326.713011][ T24] usb 4-1: Manufacturer: syz [ 326.723710][ T24] usb 4-1: SerialNumber: syz [ 326.733701][ T58] usb 3-1: new full-speed USB device number 51 using dummy_hcd [ 326.790133][ T24] kobil_sct 4-1:2.45: KOBIL USB smart card terminal converter detected [ 326.829946][ T24] usb 4-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 326.885592][ T58] usb 3-1: unable to get BOS descriptor or descriptor too short [ 326.894443][ T58] usb 3-1: not running at top speed; connect to a high speed hub [ 326.911383][ T58] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 326.927808][ T58] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 326.954474][ T58] usb 3-1: string descriptor 0 read error: -22 [ 326.963233][ T58] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 326.973446][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.015202][ T58] usb 3-1: 0:2 : does not exist [ 327.193573][ T5953] usb 4-1: USB disconnect, device number 45 [ 327.213139][ T5953] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 327.225762][ T5953] kobil_sct 4-1:2.45: device disconnected [ 327.273646][ T5925] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 327.413560][ T5925] usb 1-1: device descriptor read/64, error -71 [ 327.470903][ T9180] netlink: 36 bytes leftover after parsing attributes in process `syz.1.873'. [ 327.674050][ T5925] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 327.815303][ T5953] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 327.824540][ T9172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 327.843621][ T5925] usb 1-1: device descriptor read/64, error -71 [ 327.853358][ T9172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.922060][ T58] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 327.952337][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 327.952352][ T30] audit: type=1800 audit(1759109723.580:303): pid=9195 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.878" name="bus" dev="tmpfs" ino=1001 res=0 errno=0 [ 327.983841][ T5925] usb usb1-port1: attempt power cycle [ 328.043845][ T5953] usb 2-1: device descriptor read/64, error -71 [ 328.145699][ T58] usb 3-1: Warning! Unlikely big volume range (=7680), cval->res is probably wrong. [ 328.151084][ T5984] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 328.171293][ T58] usb 3-1: [5] FU [Mic Capture Volume] ch = 1, val = 0/7680/1 [ 328.211695][ T58] usb 3-1: 5:0: cannot get min/max values for control 3 (id 5) [ 328.248829][ T58] usb 3-1: 5:0: failed to get current value for ch 1 (-22) [ 328.317541][ T5953] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 328.325885][ T58] usb 3-1: 5:0: cannot get min/max values for control 3 (id 5) [ 328.336182][ T5984] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 328.367605][ T58] usb 3-1: USB disconnect, device number 51 [ 328.369131][ T5984] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 328.413632][ T5925] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 328.428929][ T5984] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 328.442473][ T5984] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 328.456373][ T5925] usb 1-1: device descriptor read/8, error -71 [ 328.478740][ T5984] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 328.509280][ T5984] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 328.510445][ T9205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.518701][ T5953] usb 2-1: device descriptor read/64, error -71 [ 328.536671][ T9205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.544553][ T5984] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 328.562902][ T5984] usb 4-1: Product: syz [ 328.567744][ T5984] usb 4-1: Manufacturer: syz [ 328.592628][ T5984] cdc_wdm 4-1:1.0: skipping garbage [ 328.602032][ T5984] cdc_wdm 4-1:1.0: skipping garbage [ 328.726775][ T5953] usb usb2-port1: attempt power cycle [ 328.743607][ T5925] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 328.753947][ T5984] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 328.761208][ T5984] cdc_wdm 4-1:1.0: Unknown control protocol [ 328.778618][ T5925] usb 1-1: device descriptor read/8, error -71 [ 328.800155][ T9193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.813934][ T9193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.833352][ T24] usb 4-1: USB disconnect, device number 46 [ 328.854026][ T58] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 328.923963][ T5925] usb usb1-port1: unable to enumerate USB device [ 329.014181][ T58] usb 3-1: Using ep0 maxpacket: 16 [ 329.020694][ T58] usb 3-1: config 0 has an invalid interface number: 106 but max is 0 [ 329.031263][ T58] usb 3-1: config 0 has no interface number 0 [ 329.037463][ T58] usb 3-1: config 0 interface 106 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 8 [ 329.048016][ T58] usb 3-1: config 0 interface 106 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 329.060748][ T58] usb 3-1: New USB device found, idVendor=0bb4, idProduct=0a82, bcdDevice=b1.44 [ 329.069949][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.073567][ T5953] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 329.079058][ T58] usb 3-1: Product: syz [ 329.089680][ T58] usb 3-1: Manufacturer: syz [ 329.094328][ T58] usb 3-1: SerialNumber: syz [ 329.100592][ T58] usb 3-1: config 0 descriptor?? [ 329.106257][ T9204] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 329.113769][ T9204] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 329.121280][ T5953] usb 2-1: device descriptor read/8, error -71 [ 329.123377][ T58] ipaq 3-1:0.106: PocketPC PDA converter detected [ 329.134231][ T58] usb 3-1: active config #0 != 1 ?? [ 329.243830][ T5925] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 329.323253][ T58] usb 3-1: USB disconnect, device number 52 [ 329.383751][ T5953] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 329.404539][ T5953] usb 2-1: device descriptor read/8, error -71 [ 329.411576][ T5925] usb 5-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 329.420751][ T5925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.432436][ T5925] usb 5-1: config 0 descriptor?? [ 329.513981][ T5953] usb usb2-port1: unable to enumerate USB device [ 330.068117][ T9220] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 330.113867][ T919] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 330.220206][ T9226] program syz.0.889 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 330.249364][ T5925] pegasus 5-1:0.0: probe with driver pegasus failed with error -121 [ 330.338083][ T9226] ip6tnl1: entered promiscuous mode [ 330.346139][ T9226] ip6tnl1: entered allmulticast mode [ 330.383147][ T919] usb 3-1: Using ep0 maxpacket: 32 [ 330.390341][ T919] usb 3-1: config 2 has an invalid interface number: 45 but max is 0 [ 330.398616][ T919] usb 3-1: config 2 has no interface number 0 [ 330.428692][ T919] usb 3-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 330.496749][ T919] usb 3-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 330.518419][ T919] usb 3-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 330.519110][ T9228] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 330.527837][ T919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.550418][ T919] usb 3-1: Product: syz [ 330.554946][ T919] usb 3-1: Manufacturer: syz [ 330.559754][ T919] usb 3-1: SerialNumber: syz [ 330.610422][ T9229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 330.621814][ T919] kobil_sct 3-1:2.45: KOBIL USB smart card terminal converter detected [ 330.638432][ T919] usb 3-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 330.708432][ T9228] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.145610][ T919] usb 3-1: USB disconnect, device number 53 [ 331.157687][ T919] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 331.179881][ T919] kobil_sct 3-1:2.45: device disconnected [ 331.707509][ T9244] netlink: 'syz.3.892': attribute type 30 has an invalid length. [ 332.003546][ T5925] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 332.343350][ T58] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 332.396019][ T5925] usb 1-1: Using ep0 maxpacket: 32 [ 332.418738][ T5925] usb 1-1: config 0 has an invalid interface number: 247 but max is 0 [ 332.427993][ T5925] usb 1-1: config 0 has no interface number 0 [ 332.439912][ T5925] usb 1-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 332.469316][ T5953] usb 5-1: USB disconnect, device number 41 [ 332.481266][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 332.501054][ T5925] usb 1-1: Product: syz [ 332.504171][ T58] usb 3-1: Using ep0 maxpacket: 32 [ 332.506458][ T5925] usb 1-1: Manufacturer: syz [ 332.525147][ T5925] usb 1-1: config 0 descriptor?? [ 332.534981][ T58] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 332.543379][ T58] usb 3-1: config 0 has no interface number 0 [ 332.573241][ T58] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 332.607860][ T58] usb 3-1: config 0 interface 85 has no altsetting 0 [ 332.623867][ T58] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 332.633150][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.641408][ T58] usb 3-1: Product: syz [ 332.645853][ T58] usb 3-1: Manufacturer: syz [ 332.650545][ T58] usb 3-1: SerialNumber: syz [ 332.658919][ T58] usb 3-1: config 0 descriptor?? [ 332.795604][ T24] usb 1-1: USB disconnect, device number 56 [ 332.939413][ T9254] netlink: 4 bytes leftover after parsing attributes in process `syz.4.897'. [ 333.233591][ T24] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 333.269814][ T58] appletouch 3-1:0.85: Geyser mode initialized. [ 333.283063][ T58] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input35 [ 333.328115][ T9261] netlink: 'syz.1.900': attribute type 1 has an invalid length. [ 333.364274][ T24] usb 4-1: device descriptor read/64, error -71 [ 333.496936][ T58] usb 3-1: USB disconnect, device number 54 [ 333.534296][ T58] appletouch 3-1:0.85: input: appletouch disconnected [ 333.613830][ T24] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 333.622620][ T30] audit: type=1326 audit(1759109729.250:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9252 comm="syz.4.897" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f195bd8eec9 code=0x7fc00000 [ 333.658804][ T30] audit: type=1326 audit(1759109729.250:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9252 comm="syz.4.897" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f195bd8eec9 code=0x7fc00000 [ 333.763556][ T24] usb 4-1: device descriptor read/64, error -71 [ 333.945202][ T5925] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 333.962129][ T24] usb usb4-port1: attempt power cycle [ 334.103559][ T5925] usb 1-1: Using ep0 maxpacket: 32 [ 334.141034][ T5925] usb 1-1: config 2 has an invalid interface number: 45 but max is 0 [ 334.182283][ T5925] usb 1-1: config 2 has no interface number 0 [ 334.208370][ T5925] usb 1-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 334.264830][ T5925] usb 1-1: config 2 interface 45 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 334.313899][ T24] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 334.412989][ T5925] usb 1-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 334.436099][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.454036][ T5925] usb 1-1: Product: syz [ 334.454735][ T24] usb 4-1: device descriptor read/8, error -71 [ 334.469331][ T5925] usb 1-1: Manufacturer: syz [ 334.480331][ T5925] usb 1-1: SerialNumber: syz [ 334.498784][ T5925] kobil_sct 1-1:2.45: KOBIL USB smart card terminal converter detected [ 334.699971][ T5925] usb 1-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 334.733555][ T58] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 334.743801][ T24] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 334.764647][ T24] usb 4-1: device descriptor read/8, error -71 [ 334.876520][ T24] usb usb4-port1: unable to enumerate USB device [ 334.894767][ T5984] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 334.896386][ T58] usb 3-1: Using ep0 maxpacket: 8 [ 334.932076][ T58] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 334.944497][ T58] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 334.955801][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.963917][ T58] usb 3-1: Product: syz [ 334.968122][ T58] usb 3-1: Manufacturer: syz [ 334.972690][ T58] usb 3-1: SerialNumber: syz [ 334.990834][ T58] usb 3-1: config 0 descriptor?? [ 335.011422][ T58] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 335.024929][ T58] usb 3-1: setting power ON [ 335.029439][ T58] dvb-usb: bulk message failed: -22 (2/0) [ 335.042916][ T58] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 335.055563][ T5984] usb 5-1: device descriptor read/64, error -71 [ 335.056158][ T58] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 335.081472][ T58] usb 3-1: media controller created [ 335.103351][ T58] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 335.128023][ T58] usb 3-1: selecting invalid altsetting 6 [ 335.134373][ T58] usb 3-1: digital interface selection failed (-22) [ 335.134614][ T5925] usb 1-1: USB disconnect, device number 57 [ 335.140971][ T58] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 335.141664][ T58] usb 3-1: setting power OFF [ 335.160575][ T58] dvb-usb: bulk message failed: -22 (2/0) [ 335.170049][ T58] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 335.183981][ T58] (NULL device *): no alternate interface [ 335.217807][ T5925] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 335.259492][ T58] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 335.476996][ T5925] kobil_sct 1-1:2.45: device disconnected [ 335.484133][ T5984] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 335.633551][ T5984] usb 5-1: device descriptor read/64, error -71 [ 335.743953][ T5984] usb usb5-port1: attempt power cycle [ 335.843676][ T58] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 335.919418][ T30] audit: type=1326 audit(1759109731.550:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9302 comm="syz.0.915" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe0edd8eec9 code=0x0 [ 336.142545][ T58] usb 2-1: config 0 has no interfaces? [ 336.150834][ T58] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 336.165875][ T58] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.220054][ T58] usb 2-1: Product: syz [ 336.227816][ T5984] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 336.285408][ T58] usb 2-1: Manufacturer: syz [ 336.311992][ T58] usb 2-1: SerialNumber: syz [ 336.342836][ T58] usb 2-1: config 0 descriptor?? [ 336.417450][ T5984] usb 5-1: device descriptor read/8, error -71 [ 336.580146][ T9300] FAULT_INJECTION: forcing a failure. [ 336.580146][ T9300] name failslab, interval 1, probability 0, space 0, times 0 [ 336.596840][ T9300] CPU: 0 UID: 0 PID: 9300 Comm: syz.1.914 Not tainted syzkaller #0 PREEMPT(full) [ 336.596864][ T9300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 336.596874][ T9300] Call Trace: [ 336.596882][ T9300] [ 336.596890][ T9300] dump_stack_lvl+0x189/0x250 [ 336.596915][ T9300] ? __pfx____ratelimit+0x10/0x10 [ 336.596935][ T9300] ? __pfx_dump_stack_lvl+0x10/0x10 [ 336.596956][ T9300] ? __pfx__printk+0x10/0x10 [ 336.596985][ T9300] ? __pfx___might_resched+0x10/0x10 [ 336.597002][ T9300] ? fs_reclaim_acquire+0x7d/0x100 [ 336.597024][ T9300] should_fail_ex+0x414/0x560 [ 336.597053][ T9300] should_failslab+0xa8/0x100 [ 336.597078][ T9300] __kmalloc_noprof+0xcb/0x4f0 [ 336.597099][ T9300] ? kfree+0x4d/0x440 [ 336.597117][ T9300] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 336.597145][ T9300] tomoyo_realpath_from_path+0xe3/0x5d0 [ 336.597166][ T9300] ? tomoyo_domain+0xd9/0x130 [ 336.597191][ T9300] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 336.597214][ T9300] tomoyo_path_number_perm+0x1e8/0x5a0 [ 336.597241][ T9300] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 336.597282][ T9300] ? __lock_acquire+0xab9/0xd20 [ 336.597329][ T9300] ? __fget_files+0x2a/0x420 [ 336.597349][ T9300] ? __fget_files+0x2a/0x420 [ 336.597363][ T9300] ? __fget_files+0x3a0/0x420 [ 336.597378][ T9300] ? __fget_files+0x2a/0x420 [ 336.597398][ T9300] security_file_ioctl+0xcb/0x2d0 [ 336.597424][ T9300] __se_sys_ioctl+0x47/0x170 [ 336.597447][ T9300] do_syscall_64+0xfa/0x3b0 [ 336.597466][ T9300] ? lockdep_hardirqs_on+0x9c/0x150 [ 336.597482][ T9300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.597499][ T9300] ? clear_bhb_loop+0x60/0xb0 [ 336.597521][ T9300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.597537][ T9300] RIP: 0033:0x7fb57398eec9 [ 336.597554][ T9300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 336.597569][ T9300] RSP: 002b:00007fb57489a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 336.597588][ T9300] RAX: ffffffffffffffda RBX: 00007fb573be6090 RCX: 00007fb57398eec9 [ 336.597601][ T9300] RDX: 0000200000000540 RSI: 00000000c1205531 RDI: 0000000000000008 [ 336.597613][ T9300] RBP: 00007fb57489a090 R08: 0000000000000000 R09: 0000000000000000 [ 336.597625][ T9300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.597635][ T9300] R13: 00007fb573be6128 R14: 00007fb573be6090 R15: 00007fb573d0fa28 [ 336.597666][ T9300] [ 336.598290][ T9300] ERROR: Out of memory at tomoyo_realpath_from_path. [ 336.913650][ T5984] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 336.947086][ T5984] usb 5-1: device descriptor read/8, error -71 [ 337.026780][ T9] usb 2-1: USB disconnect, device number 43 [ 337.067496][ T5984] usb usb5-port1: unable to enumerate USB device [ 337.243553][ T919] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 337.396102][ T9318] pim6reg: entered allmulticast mode [ 337.508193][ T919] usb 4-1: Using ep0 maxpacket: 8 [ 337.516036][ T919] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 337.526662][ T919] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.545787][ T919] usb 4-1: config 0 has no interface number 0 [ 337.674683][ T919] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 337.693433][ T919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.701521][ T919] usb 4-1: Product: syz [ 337.713441][ T919] usb 4-1: Manufacturer: syz [ 337.719381][ T919] usb 4-1: SerialNumber: syz [ 337.774931][ T919] usb 4-1: config 0 descriptor?? [ 337.992348][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 338.004076][ T919] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 338.021310][ T919] usb 4-1: No valid video chain found. [ 338.159305][ T919] usb 4-1: USB disconnect, device number 51 [ 338.487958][ T919] usb 3-1: USB disconnect, device number 55 [ 338.888292][ T5984] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 339.010692][ T9343] netlink: 28 bytes leftover after parsing attributes in process `syz.1.925'. [ 339.130914][ T5984] usb 4-1: device descriptor read/64, error -71 [ 339.453586][ T5984] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 339.623561][ T5984] usb 4-1: device descriptor read/64, error -71 [ 339.769285][ T5984] usb usb4-port1: attempt power cycle [ 340.000408][ T9] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 340.117863][ T9355] fuse: Unknown parameter 'user_i00000000000000000000' [ 340.129714][ T5984] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 340.154335][ T5984] usb 4-1: device descriptor read/8, error -71 [ 340.186875][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 340.212236][ T9] usb 3-1: config 0 has an invalid interface number: 63 but max is 0 [ 340.244814][ T9] usb 3-1: config 0 has no interface number 0 [ 340.261251][ T9] usb 3-1: config 0 interface 63 altsetting 119 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 340.297074][ T9] usb 3-1: config 0 interface 63 has no altsetting 0 [ 340.310314][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=0896, bcdDevice=3a.11 [ 340.320236][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.328410][ T9] usb 3-1: Product: syz [ 340.332595][ T9] usb 3-1: Manufacturer: syz [ 340.338503][ T9] usb 3-1: SerialNumber: syz [ 340.350980][ T9] usb 3-1: config 0 descriptor?? [ 340.375413][ T9] gspca_main: vc032x-2.14.0 probing 046d:0896 [ 340.403553][ T5984] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 340.434769][ T5984] usb 4-1: device descriptor read/8, error -71 [ 340.445542][ T5925] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 340.483507][ T30] audit: type=1326 audit(1759109736.110:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.4.932" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f195bd8eec9 code=0x0 [ 340.569443][ T5984] usb usb4-port1: unable to enumerate USB device [ 340.591010][ T9352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.606068][ T9352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.624496][ T5925] usb 1-1: Using ep0 maxpacket: 16 [ 340.675596][ T5925] usb 1-1: config 0 has no interfaces? [ 340.691535][ T5925] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 340.700678][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.713753][ T5925] usb 1-1: Product: syz [ 340.730726][ T5925] usb 1-1: Manufacturer: syz [ 340.773333][ T5925] usb 1-1: SerialNumber: syz [ 340.795337][ T5925] usb 1-1: config 0 descriptor?? [ 340.883790][ T9] gspca_vc032x: reg_r err -110 [ 340.888625][ T9] vc032x 3-1:0.63: probe with driver vc032x failed with error -110 [ 341.926510][ T9370] netlink: 4 bytes leftover after parsing attributes in process `syz.3.933'. [ 342.047030][ T9377] netlink: 19 bytes leftover after parsing attributes in process `syz.4.934'. [ 342.645481][ T919] usb 3-1: USB disconnect, device number 56 [ 342.917829][ T9395] netlink: 'syz.2.938': attribute type 21 has an invalid length. [ 342.926787][ T9396] trusted_key: encrypted_key: master key parameter '' is invalid [ 343.219976][ T5925] usb 1-1: USB disconnect, device number 58 [ 343.327599][ T9396] netlink: 232 bytes leftover after parsing attributes in process `syz.1.940'. [ 343.747858][ T5925] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 343.777625][ T30] audit: type=1326 audit(1759109739.410:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9411 comm="syz.2.944" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e3e98eec9 code=0x0 [ 343.978071][ T30] audit: type=1326 audit(1759109739.600:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9413 comm="syz.1.945" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb57398eec9 code=0x0 [ 344.014033][ T5925] usb 1-1: no configurations [ 344.018631][ T5925] usb 1-1: can't read configurations, error -22 [ 344.281853][ T5925] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 344.496141][ T5925] usb 1-1: no configurations [ 344.505656][ T9425] netlink: 19 bytes leftover after parsing attributes in process `syz.4.946'. [ 344.534243][ T5925] usb 1-1: can't read configurations, error -22 [ 344.543781][ T5925] usb usb1-port1: attempt power cycle [ 344.975918][ T9434] sctp: [Deprecated]: syz.3.950 (pid 9434) Use of struct sctp_assoc_value in delayed_ack socket option. [ 344.975918][ T9434] Use struct sctp_sack_info instead [ 345.024088][ T5925] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 345.055843][ T5925] usb 1-1: no configurations [ 345.060471][ T5925] usb 1-1: can't read configurations, error -22 [ 345.073683][ T58] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 345.118853][ T9441] netlink: 4 bytes leftover after parsing attributes in process `syz.1.951'. [ 345.259776][ T58] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.276042][ T58] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 345.287626][ T58] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.306966][ T58] usb 3-1: config 0 descriptor?? [ 345.425287][ T5925] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 345.466796][ T5925] usb 1-1: no configurations [ 345.488361][ T9449] netlink: 'syz.3.954': attribute type 1 has an invalid length. [ 345.499486][ T9449] netlink: 28 bytes leftover after parsing attributes in process `syz.3.954'. [ 345.628258][ T5925] usb 1-1: can't read configurations, error -22 [ 345.646447][ T5925] usb usb1-port1: unable to enumerate USB device [ 346.209929][ T30] audit: type=1326 audit(1759109741.830:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9455 comm="syz.3.957" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faf30f8eec9 code=0x0 [ 346.427867][ T9463] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 346.733676][ T9] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 346.913986][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 346.933246][ T9] usb 1-1: config index 0 descriptor too short (expected 56850, got 18) [ 346.951667][ T9] usb 1-1: config 202 has too many interfaces: 82, using maximum allowed: 32 [ 346.983533][ T9] usb 1-1: config 202 has an invalid descriptor of length 214, skipping remainder of the config [ 347.109320][ T9] usb 1-1: config 202 has 0 interfaces, different from the descriptor's value: 82 [ 347.385324][ T9] usb 1-1: New USB device found, idVendor=0403, idProduct=da73, bcdDevice= 8.d0 [ 347.421862][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.691331][ T9] usb 1-1: string descriptor 0 read error: -71 [ 347.726643][ T9] usb 1-1: USB disconnect, device number 63 [ 347.854364][ T58] usbhid 3-1:0.0: can't add hid device: -71 [ 347.860920][ T58] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 347.892761][ T58] usb 3-1: USB disconnect, device number 57 [ 347.981670][ T9473] binder: BINDER_SET_CONTEXT_MGR already set [ 347.988608][ T9473] binder: 9472:9473 ioctl 4018620d 200000000040 returned -16 [ 348.079209][ T9475] sctp: [Deprecated]: syz.2.962 (pid 9475) Use of struct sctp_assoc_value in delayed_ack socket option. [ 348.079209][ T9475] Use struct sctp_sack_info instead [ 348.613543][ T5953] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 348.653579][ T58] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 348.761097][ T30] audit: type=1326 audit(1759109744.390:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9492 comm="syz.4.970" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f195bd8eec9 code=0x0 [ 348.787956][ T5953] usb 4-1: config 0 has an invalid interface number: 204 but max is 0 [ 348.796356][ T5953] usb 4-1: config 0 has no interface number 0 [ 348.807858][ T5953] usb 4-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=29.3d [ 348.808181][ T58] usb 1-1: no configurations [ 348.821727][ T58] usb 1-1: can't read configurations, error -22 [ 348.823901][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.843645][ T5953] usb 4-1: Product: syz [ 348.849355][ T5953] usb 4-1: Manufacturer: syz [ 348.858128][ T5953] usb 4-1: SerialNumber: syz [ 348.876512][ T5953] usb 4-1: config 0 descriptor?? [ 348.898349][ T5953] ems_usb 4-1:0.204 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 348.913795][ T24] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 348.918318][ T5953] ems_usb 4-1:0.204: probe with driver ems_usb failed with error -22 [ 348.963672][ T58] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 349.088415][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 349.106992][ T9483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 349.119768][ T9483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.119798][ T24] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 349.141008][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.146699][ T5925] usb 4-1: USB disconnect, device number 56 [ 349.149716][ T58] usb 1-1: no configurations [ 349.168446][ T58] usb 1-1: can't read configurations, error -22 [ 349.178221][ T24] usb 3-1: config 0 descriptor?? [ 349.230552][ T58] usb usb1-port1: attempt power cycle [ 349.236478][ T5953] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 349.393562][ T5953] usb 2-1: Using ep0 maxpacket: 8 [ 349.401852][ T5953] usb 2-1: unable to get BOS descriptor or descriptor too short [ 349.411354][ T5953] usb 2-1: config index 0 descriptor too short (expected 35858, got 18) [ 349.420169][ T5953] usb 2-1: config 116 has an invalid descriptor of length 117, skipping remainder of the config [ 349.431239][ T5953] usb 2-1: config 116 has 0 interfaces, different from the descriptor's value: 4 [ 349.447419][ T5953] usb 2-1: New USB device found, idVendor=110a, idProduct=0751, bcdDevice=79.99 [ 349.456913][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.469054][ T5953] usb 2-1: Product: 㵝㛻･킬ﶼ⌱빡둞﹚漑捃ꅧꜪ䍺ἣﰹ㲂说睞ￔ礠⁊漉㧰ㅳ뢵躓⫘䢂뼾﯑⤝住ᦆ怜،樬濳仰里⽺橥๠ማ䡕՗⫗年䔡뱵⢫뀣뷩鷹큾緿얏㹬究뇖䇜㧜뭿෹͖荵礆๩ḕ룲美倰禆὇颩瀑ꆁѪ菱촅罄㨸虶ꜽ [ 349.497727][ C0] vkms_vblank_simulate: vblank timer overrun [ 349.537808][ T5953] usb 2-1: Manufacturer: ᶦ㥑쎪߉扐礢ᘗ絉￥﨤惷쳜題쀆걺ꬼ筱騌搅燁㼲ි邽㖲䃦Ⱂ雩똊큆ⷝ죮貖䔠㣧붨靫ᒈ텏粰뮔ᗠ螑᧯璗⡵뷑冬臚䈍ᑗ僂丛జ伱킖箘ᎌ泅䛸⮔ꐝ뎖뭳脎෡苘搭ɏＪ⾌漙텴ἁ㭩ጧ㥔濺娮틞ᦃ갱삪਷Ꙙ룂ᄧ㌓騂ộꣁ硇䈨ﰎ枛ἡⶔ렖ֳ촾鞮撱韞衃画엤؟ [ 349.572037][ C0] vkms_vblank_simulate: vblank timer overrun [ 349.583632][ T58] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 349.587888][ T5953] usb 2-1: SerialNumber: ࡡ [ 349.607403][ T58] usb 1-1: no configurations [ 349.612382][ T58] usb 1-1: can't read configurations, error -22 [ 349.748103][ T58] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 349.807607][ T58] usb 1-1: no configurations [ 349.812285][ T58] usb 1-1: can't read configurations, error -22 [ 349.829248][ T58] usb usb1-port1: unable to enumerate USB device [ 349.850660][ T5953] usb 2-1: USB disconnect, device number 44 [ 350.008247][ T9509] netlink: 28 bytes leftover after parsing attributes in process `syz.4.974'. [ 350.216864][ T9513] netlink: 4 bytes leftover after parsing attributes in process `syz.4.975'. [ 350.550559][ T9519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.977'. [ 350.562250][ T9519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.977'. [ 351.679721][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 351.743677][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 351.786683][ T24] usb 3-1: USB disconnect, device number 58 [ 351.793671][ T5918] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 352.013622][ T5918] usb 1-1: Using ep0 maxpacket: 32 [ 352.021695][ T5918] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 352.033146][ T5918] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 352.044159][ T5918] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 352.058171][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.084594][ T5918] hub 1-1:4.0: USB hub found [ 352.250998][ T30] audit: type=1326 audit(1759109747.860:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9532 comm="syz.3.984" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faf30f8eec9 code=0x0 [ 352.345801][ T5918] hub 1-1:4.0: config failed, can't read hub descriptor (err -90) [ 352.551496][ T9523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.564094][ T9523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.629651][ T5918] usbhid 1-1:4.0: can't add hid device: -71 [ 352.638477][ T5918] usbhid 1-1:4.0: probe with driver usbhid failed with error -71 [ 352.688128][ T5918] usb 1-1: USB disconnect, device number 68 [ 353.093799][ T24] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 353.112250][ T9550] fuse: Bad value for 'user_id' [ 353.120230][ T9550] fuse: Bad value for 'user_id' [ 353.207655][ T9552] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 353.215800][ T9552] IPv6: NLM_F_CREATE should be set when creating new route [ 353.226125][ T9552] lo: entered allmulticast mode [ 353.256631][ T9552] tunl0: entered allmulticast mode [ 353.266854][ T9552] gre0: entered allmulticast mode [ 353.282788][ T24] usb 3-1: no configurations [ 353.297628][ T24] usb 3-1: can't read configurations, error -22 [ 353.297662][ T9553] input: syz1 as /devices/virtual/input/input36 [ 353.329062][ T9552] gretap0: entered allmulticast mode [ 353.375162][ T9552] erspan0: entered allmulticast mode [ 353.383679][ T5918] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 353.392261][ T9552] ip_vti0: entered allmulticast mode [ 353.421720][ T9552] ip6_vti0: entered allmulticast mode [ 353.434924][ T9552] sit0: entered allmulticast mode [ 353.447379][ T9552] ip6tnl0: entered allmulticast mode [ 353.461380][ T9552] ip6gre0: entered allmulticast mode [ 353.470153][ T9552] syz_tun: entered allmulticast mode [ 353.482265][ T9552] ip6gretap0: entered allmulticast mode [ 353.483708][ T24] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 353.492311][ T9552] vcan0: entered allmulticast mode [ 353.508072][ T9552] bond0: entered allmulticast mode [ 353.515943][ T9552] bond_slave_0: entered allmulticast mode [ 353.521747][ T9552] bond_slave_1: entered allmulticast mode [ 353.539955][ T9552] team0: entered allmulticast mode [ 353.549969][ T5918] usb 2-1: Using ep0 maxpacket: 16 [ 353.556562][ T9552] team_slave_0: entered allmulticast mode [ 353.562599][ T9552] team_slave_1: entered allmulticast mode [ 353.582142][ T9552] dummy0: entered allmulticast mode [ 353.602928][ T9556] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 353.618044][ T9556] openvswitch: netlink: Duplicate or invalid key (type 0). [ 353.625691][ T9556] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.664368][ T9552] nlmon0: entered allmulticast mode [ 353.672303][ T9552] 0X: entered allmulticast mode [ 353.679385][ T24] usb 3-1: no configurations [ 353.684531][ T24] usb 3-1: can't read configurations, error -22 [ 353.702375][ T24] usb usb3-port1: attempt power cycle [ 353.703026][ T9552] batadv0: entered allmulticast mode [ 353.715944][ T9552] vxcan0: entered allmulticast mode [ 353.724472][ T9552] vxcan1: entered allmulticast mode [ 353.732729][ T9552] veth0: entered allmulticast mode [ 353.748306][ T9552] veth1: entered allmulticast mode [ 353.760241][ T9552] wg0: entered allmulticast mode [ 353.772103][ T9552] wg1: entered allmulticast mode [ 353.774240][ T30] audit: type=1326 audit(1759109749.410:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.3.991" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faf30f8eec9 code=0x0 [ 353.803049][ T9552] wg2: entered allmulticast mode [ 353.810514][ T9552] veth0_to_bridge: entered allmulticast mode [ 353.819889][ T9552] bridge_slave_0: entered allmulticast mode [ 353.838748][ T9552] veth1_to_bridge: entered allmulticast mode [ 353.853057][ T9552] bridge_slave_1: entered allmulticast mode [ 353.875645][ T9552] veth0_to_bond: entered allmulticast mode [ 353.901326][ T9552] veth1_to_bond: entered allmulticast mode [ 353.914335][ T9552] veth0_to_team: entered allmulticast mode [ 353.927049][ T9552] veth1_to_team: entered allmulticast mode [ 353.939688][ T9552] veth0_to_batadv: entered allmulticast mode [ 353.962024][ T9552] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 353.971353][ T9552] batadv_slave_0: entered allmulticast mode [ 354.009677][ T9552] veth1_to_batadv: entered allmulticast mode [ 354.021638][ T9552] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 354.029798][ T9552] batadv_slave_1: entered allmulticast mode [ 354.040083][ T9552] xfrm0: entered allmulticast mode [ 354.051603][ T9552] veth0_to_hsr: entered allmulticast mode [ 354.062839][ T9552] hsr_slave_0: entered allmulticast mode [ 354.069209][ T24] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 354.082277][ T9552] veth1_to_hsr: entered allmulticast mode [ 354.095206][ T9552] hsr_slave_1: entered allmulticast mode [ 354.106139][ T24] usb 3-1: no configurations [ 354.110806][ T24] usb 3-1: can't read configurations, error -22 [ 354.117447][ T9552] hsr0: entered allmulticast mode [ 354.133426][ T9552] veth1_virt_wifi: entered allmulticast mode [ 354.141198][ T9566] ptrace attach of "./syz-executor exec"[5884] was attempted by "./syz-executor exec"[9566] [ 354.179929][ T9552] veth0_virt_wifi: entered allmulticast mode [ 354.190951][ T9552] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 354.205369][ T9552] veth1_vlan: entered allmulticast mode [ 354.271240][ T9552] veth0_vlan: entered allmulticast mode [ 354.276895][ T24] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 354.301788][ T24] usb 3-1: no configurations [ 354.306524][ T24] usb 3-1: can't read configurations, error -22 [ 354.319693][ T24] usb usb3-port1: unable to enumerate USB device [ 354.333351][ T9552] vlan0: entered allmulticast mode [ 354.356283][ T9552] vlan1: entered allmulticast mode [ 354.400009][ T9552] macvlan0: entered allmulticast mode [ 354.415977][ T9552] macvlan1: entered allmulticast mode [ 354.430474][ T9552] ipvlan0: entered allmulticast mode [ 354.437740][ T9552] ipvlan1: entered allmulticast mode [ 354.446547][ T9552] veth1_macvtap: entered allmulticast mode [ 354.457717][ T9552] veth0_macvtap: entered allmulticast mode [ 354.476740][ T9552] macvtap0: entered allmulticast mode [ 354.497176][ T9552] macsec0: entered allmulticast mode [ 354.587798][ T9552] geneve0: entered allmulticast mode [ 354.603357][ T9552] geneve1: entered allmulticast mode [ 354.618091][ T9552] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 354.630362][ T9552] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 354.643979][ T9552] netdevsim netdevsim0 netdevsim2: entered allmulticast mode [ 354.662328][ T9552] netdevsim netdevsim0 netdevsim3: entered allmulticast mode [ 354.692680][ T9552] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode [ 354.706007][ T9552] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 354.716826][ T9552] bond1: left promiscuous mode [ 354.729446][ T9552] bond2: left promiscuous mode [ 354.740356][ T9552] bond3: entered allmulticast mode [ 354.747373][ T9552] bond4: left promiscuous mode [ 354.768859][ T9552] bond5: left promiscuous mode [ 354.792970][ T9552] bond6: entered allmulticast mode [ 354.813679][ T9552] vxcan2: entered allmulticast mode [ 354.819220][ T9552] vxcan3: entered allmulticast mode [ 354.829282][ T9552] : entered allmulticast mode [ 354.847381][ T9552] ip6gretap1: entered allmulticast mode [ 354.875524][ T9552] ip6tnl1: left promiscuous mode [ 354.900354][ T9554] ipvlan1: left allmulticast mode [ 354.941979][ T59] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.961681][ T59] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.000002][ T59] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.033544][ T59] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.813627][ T24] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 355.899599][ T58] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 355.907496][ T5918] usb 2-1: unable to get BOS descriptor or descriptor too short [ 355.928899][ T5918] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 355.942195][ T5918] usb 2-1: can't read configurations, error -71 [ 355.996658][ T9588] sctp: [Deprecated]: syz.1.1001 (pid 9588) Use of struct sctp_assoc_value in delayed_ack socket option. [ 355.996658][ T9588] Use struct sctp_sack_info instead [ 356.003893][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 356.059433][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 356.122244][ T30] audit: type=1326 audit(1759109751.710:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9585 comm="syz.2.1000" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e3e98eec9 code=0x0 [ 356.126073][ T58] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 356.184953][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 356.196440][ T58] usb 1-1: config 1 has no interface number 0 [ 356.202826][ T58] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 64 [ 356.232566][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 356.242925][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.251228][ T58] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 356.269197][ T24] usb 4-1: Product: syz [ 356.278480][ T24] usb 4-1: Manufacturer: syz [ 356.289281][ T58] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 356.301989][ T24] usb 4-1: SerialNumber: syz [ 356.315098][ T58] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.324856][ T24] usb 4-1: config 0 descriptor?? [ 356.336687][ T9593] loop9: detected capacity change from 0 to 7 [ 356.355652][ T8278] Dev loop9: unable to read RDB block 7 [ 356.369182][ T8278] loop9: AHDI p3 p4 [ 356.378249][ T24] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 356.388365][ T8278] loop9: partition table partially beyond EOD, truncated [ 356.396569][ T58] usb 1-1: Product: syz [ 356.401225][ T58] usb 1-1: Manufacturer: syz [ 356.405933][ T58] usb 1-1: SerialNumber: syz [ 356.411022][ T24] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 356.416688][ T8278] loop9: p3 size 4227858431 extends beyond EOD, truncated [ 356.476453][ T9584] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 356.562336][ T9593] Dev loop9: unable to read RDB block 7 [ 356.580966][ T58] usb 1-1: Error in usbnet_get_endpoints (-22) [ 356.613631][ T9593] loop9: AHDI p3 p4 [ 356.617678][ T9593] loop9: partition table partially beyond EOD, truncated [ 356.626339][ T9593] loop9: p3 size 4227858431 extends beyond EOD, truncated [ 356.820032][ T8278] udevd[8278]: inotify_add_watch(7, /dev/loop9p3, 10) failed: No such file or directory [ 356.945707][ T9596] fuse: Bad value for 'fd' [ 357.198115][ T24] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 357.205223][ T24] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 357.236099][ T9601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 357.271492][ T9601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.448370][ T9609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1003'. [ 357.483585][ T5953] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 357.657041][ T5953] usb 3-1: Using ep0 maxpacket: 8 [ 357.682500][ T5953] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 357.709011][ T5953] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 357.729149][ T5953] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 357.745542][ T5953] usb 3-1: config 0 has no interface number 0 [ 357.779130][ T5953] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 357.814642][ T5953] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 357.836074][ T24] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 357.848157][ T5953] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 210 [ 357.858725][ T5953] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 357.884451][ T5953] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 357.894447][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.904925][ T5953] usb 3-1: Product: syz [ 357.915642][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 357.925582][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 357.939089][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 357.948454][ T5953] usb 3-1: Manufacturer: syz [ 357.949235][ T9610] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1007'. [ 357.967356][ T9610] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1007'. [ 357.970466][ T5953] usb 3-1: SerialNumber: syz [ 357.982852][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 358.003426][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 358.042725][ T5953] usb 3-1: config 0 descriptor?? [ 358.066326][ T9602] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 358.082997][ T5953] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 358.299280][ T5918] usb 3-1: USB disconnect, device number 63 [ 358.516918][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 358.524004][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 358.535495][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 358.542927][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 358.550111][ T24] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 358.571043][ T24] usb 4-1: USB disconnect, device number 57 [ 358.727427][ T5953] usb 1-1: USB disconnect, device number 69 [ 359.273694][ T5925] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 359.275010][ T9627] sctp: [Deprecated]: syz.3.1012 (pid 9627) Use of struct sctp_assoc_value in delayed_ack socket option. [ 359.275010][ T9627] Use struct sctp_sack_info instead [ 359.461364][ T5925] usb 3-1: too many configurations: 17, using maximum allowed: 8 [ 359.471175][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.482854][ T5925] usb 3-1: config 0 has no interfaces? [ 359.495635][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.508807][ T5925] usb 3-1: config 0 has no interfaces? [ 359.516852][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.530167][ T5925] usb 3-1: config 0 has no interfaces? [ 359.570772][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.595467][ T5925] usb 3-1: config 0 has no interfaces? [ 359.611695][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.723697][ T5953] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 359.807515][ T5925] usb 3-1: config 0 has no interfaces? [ 359.816619][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.827081][ T5925] usb 3-1: config 0 has no interfaces? [ 359.835009][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.845290][ T5925] usb 3-1: config 0 has no interfaces? [ 359.857870][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.901055][ T5953] usb 4-1: Using ep0 maxpacket: 32 [ 359.907959][ T5953] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 359.921179][ T5953] usb 4-1: config 0 has no interface number 0 [ 359.938217][ T5953] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 359.955174][ T5925] usb 3-1: config 0 has no interfaces? [ 359.963029][ T5953] usb 4-1: config 0 interface 85 has no altsetting 0 [ 359.972358][ T5925] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 359.981878][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.990252][ T5925] usb 3-1: Product: syz [ 359.996913][ T5953] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 360.006889][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.016280][ T5925] usb 3-1: Manufacturer: syz [ 360.022125][ T5953] usb 4-1: Product: syz [ 360.027343][ T5925] usb 3-1: SerialNumber: syz [ 360.032156][ T5953] usb 4-1: Manufacturer: syz [ 360.042289][ T5953] usb 4-1: SerialNumber: syz [ 360.050488][ T5925] usb 3-1: config 0 descriptor?? [ 360.065089][ T5953] usb 4-1: config 0 descriptor?? [ 360.286808][ T5925] usb 3-1: USB disconnect, device number 64 [ 360.586280][ T9635] fuse: Bad value for 'fd' [ 360.699475][ T5953] appletouch 4-1:0.85: Geyser mode initialized. [ 360.716165][ T5953] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input37 [ 360.777213][ T30] audit: type=1326 audit(1759109756.380:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9636 comm="syz.0.1016" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe0edd8eec9 code=0x0 [ 360.798835][ C0] vkms_vblank_simulate: vblank timer overrun [ 360.964971][ T5953] usb 4-1: USB disconnect, device number 58 [ 361.271371][ T5953] appletouch 4-1:0.85: input: appletouch disconnected [ 361.634883][ T9651] fuse: Bad value for 'fd' [ 361.673627][ T5918] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 361.727831][ T9654] No buffer was provided with the request [ 361.740453][ T9654] trusted_key: encrypted_key: insufficient parameters specified [ 361.823588][ T5918] usb 3-1: Using ep0 maxpacket: 32 [ 361.830681][ T5918] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 361.842439][ T5918] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 361.876942][ T5918] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 361.923604][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.990236][ T5918] hub 3-1:4.0: USB hub found [ 362.191505][ T5918] hub 3-1:4.0: config failed, can't read hub descriptor (err -90) [ 362.351977][ T30] audit: type=1326 audit(1759109757.980:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.380928][ T30] audit: type=1326 audit(1759109757.980:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.408424][ T30] audit: type=1326 audit(1759109757.980:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.411478][ T9646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.430720][ C0] vkms_vblank_simulate: vblank timer overrun [ 362.449323][ T30] audit: type=1326 audit(1759109757.980:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.493939][ T9646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.661067][ T5918] usbhid 3-1:4.0: can't add hid device: -71 [ 362.678020][ T5918] usbhid 3-1:4.0: probe with driver usbhid failed with error -71 [ 362.686282][ T24] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 362.690208][ T30] audit: type=1326 audit(1759109757.980:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.716128][ C0] vkms_vblank_simulate: vblank timer overrun [ 362.765720][ T5918] usb 3-1: USB disconnect, device number 65 [ 362.778552][ T30] audit: type=1326 audit(1759109757.980:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.800792][ C0] vkms_vblank_simulate: vblank timer overrun [ 362.815420][ T30] audit: type=1326 audit(1759109757.980:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.853183][ T30] audit: type=1326 audit(1759109757.980:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.858993][ T9662] sctp: [Deprecated]: syz.1.1023 (pid 9662) Use of struct sctp_assoc_value in delayed_ack socket option. [ 362.858993][ T9662] Use struct sctp_sack_info instead [ 362.880336][ T30] audit: type=1326 audit(1759109757.980:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9657 comm="syz.1.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb57398eec9 code=0x7ffc0000 [ 362.914220][ C0] vkms_vblank_simulate: vblank timer overrun [ 362.927373][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 362.939661][ T24] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 362.948007][ T24] usb 1-1: config 0 has no interface number 0 [ 362.954556][ T24] usb 1-1: config 0 interface 41 has no altsetting 0 [ 362.963513][ T24] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 362.973016][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.986743][ T24] usb 1-1: Product: syz [ 362.997324][ T24] usb 1-1: Manufacturer: syz [ 363.007779][ T24] usb 1-1: SerialNumber: syz [ 363.033274][ T24] usb 1-1: config 0 descriptor?? [ 363.049537][ T24] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -22 [ 363.300666][ T9668] vivid-000: ================= START STATUS ================= [ 363.308425][ T9668] vivid-000: Test Pattern: 75% Colorbar [ 363.314048][ T9668] vivid-000: Fill Percentage of Frame: 100 [ 363.319955][ T9668] vivid-000: Horizontal Movement: Move Right Slow [ 363.326489][ T9668] vivid-000: Vertical Movement: No Movement [ 363.395962][ T9668] vivid-000: OSD Text Mode: All [ 363.476731][ T9668] vivid-000: Show Border: false [ 363.482797][ T9668] vivid-000: Show Square: false [ 363.494490][ T9668] vivid-000: Sensor Flipped Horizontally: false [ 363.515118][ T9668] vivid-000: Sensor Flipped Vertically: false [ 363.533623][ T9668] vivid-000: Insert SAV Code in Image: false [ 363.544213][ T9668] vivid-000: Insert EAV Code in Image: false [ 363.556936][ T5918] usb 1-1: USB disconnect, device number 70 [ 363.581163][ T9668] vivid-000: Insert Video Guard Band: false [ 363.592286][ T9672] fuse: Bad value for 'fd' [ 363.598052][ T9668] vivid-000: Reduced Framerate: false [ 363.613724][ T9668] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 363.633343][ T9668] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 363.652746][ T9668] vivid-000: Enable Capture Cropping: true grabbed [ 363.668219][ T9668] vivid-000: Enable Capture Composing: true grabbed [ 363.683997][ T9668] vivid-000: Enable Capture Scaler: true grabbed [ 363.691103][ T9668] vivid-000: Timestamp Source: End of Frame [ 363.699166][ T9668] vivid-000: Colorspace: SMPTE 170M [ 363.708105][ T9668] vivid-000: Transfer Function: Default [ 363.719462][ T9668] vivid-000: Y'CbCr Encoding: Default [ 363.728861][ T9668] vivid-000: HSV Encoding: Hue 0-179 [ 363.735984][ T9668] vivid-000: Quantization: Default [ 363.741238][ T9668] vivid-000: Apply Alpha To Red Only: false [ 363.751423][ T9668] vivid-000: Standard Aspect Ratio: 4x3 [ 363.921517][ T9668] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 363.930307][ T9668] vivid-000: DV Timings: 640x480p59 inactive [ 363.937052][ T9668] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 363.985021][ T9668] vivid-000: Maximum EDID Blocks: 2 [ 364.016682][ T9668] vivid-000: Limited RGB Range (16-235): false [ 364.074634][ T9668] vivid-000: Rx RGB Quantization Range: Automatic [ 364.094583][ T9668] vivid-000: Power Present: 0x00000001 [ 364.117549][ T9668] tpg source WxH: 720x576 (Y'CbCr) [ 364.145408][ T9668] tpg field: 4 [ 364.153228][ T9668] tpg crop: (0,8)/720x16 [ 364.183047][ T9668] tpg compose: (0,560)/180x16 [ 364.197553][ T9668] tpg colorspace: 1 [ 364.207456][ T9668] tpg transfer function: 0/1 [ 364.231696][ T9668] tpg Y'CbCr encoding: 0/1 [ 364.252431][ T9668] tpg quantization: 0/2 [ 364.271413][ T9668] tpg RGB range: 0/2 [ 364.284694][ T9668] vivid-000: ================== END STATUS ================== [ 364.376212][ T9681] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1028'. [ 366.761401][ T9703] sctp: [Deprecated]: syz.3.1034 (pid 9703) Use of struct sctp_assoc_value in delayed_ack socket option. [ 366.761401][ T9703] Use struct sctp_sack_info instead [ 366.913622][ T24] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 366.921222][ T5918] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 367.193537][ T5918] usb 2-1: Using ep0 maxpacket: 16 [ 367.198685][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 367.232053][ T5918] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 367.243763][ T5918] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 367.255064][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 367.266775][ T5918] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 367.275770][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 367.289420][ T5918] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 367.344339][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.353124][ T5918] usb 2-1: Product: syz [ 367.358158][ T5918] usb 2-1: Manufacturer: syz [ 367.364146][ T5918] usb 2-1: SerialNumber: syz [ 367.369065][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 367.393165][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.427742][ T24] usb 3-1: Product: syz [ 367.455483][ T24] usb 3-1: Manufacturer: syz [ 367.461368][ T24] usb 3-1: SerialNumber: syz [ 367.497477][ T24] usb 3-1: config 0 descriptor?? [ 367.522800][ T24] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 367.545957][ T24] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 367.966902][ T5918] usb 2-1: 0:2 : does not exist [ 368.162849][ T9711] fuse: Unknown parameter '0x0000000000000003' [ 368.182574][ T24] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 368.189653][ T24] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 368.332982][ T9713] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1038'. [ 368.388166][ T9713] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 368.442667][ T9713] gretap1: entered promiscuous mode [ 368.486184][ T9713] gretap1: entered allmulticast mode [ 368.868037][ T24] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 368.879842][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 368.913508][ T5953] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 368.933880][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 368.940878][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 368.956394][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 368.963345][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 369.094636][ T5953] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 369.108202][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 369.116741][ T5953] usb 5-1: Product: syz [ 369.121088][ T5953] usb 5-1: SerialNumber: syz [ 369.125940][ T9] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 369.161536][ T5953] usb 5-1: config 0 descriptor?? [ 369.283520][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 369.292787][ T9] usb 1-1: config 0 has an invalid interface number: 247 but max is 0 [ 369.302047][ T9] usb 1-1: config 0 has no interface number 0 [ 369.320718][ T9] usb 1-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 369.330319][ T9] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 369.339236][ T9] usb 1-1: Product: syz [ 369.392251][ T9] usb 1-1: Manufacturer: syz [ 369.414130][ T5953] hso 5-1:0.0: Failed to find BULK IN ep [ 369.431700][ T9] usb 1-1: config 0 descriptor?? [ 369.576835][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 20 [ 369.587500][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 16 [ 369.598481][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 12 [ 369.606134][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 14 [ 369.613134][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 18 [ 369.796172][ T9726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.798277][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 22 [ 369.827257][ T24] em28xx 3-1:0.0: couldn't setup AC97 register 24 [ 369.885054][ T9726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.904102][ T24] em28xx 3-1:0.0: Binding audio extension [ 369.913021][ T24] em28xx 3-1:0.0: em28xx-audio.c: Copyright (C) 2006 Markus Rechberger [ 369.932956][ T24] em28xx 3-1:0.0: em28xx-audio.c: Copyright (C) 2007-2016 Mauro Carvalho Chehab [ 370.120194][ T24] em28xx 3-1:0.0: alt 0 doesn't exist on interface 7 [ 370.141522][ T24] usb 3-1: USB disconnect, device number 66 [ 370.160194][ T24] em28xx 3-1:0.0: Disconnecting em28xx [ 370.167773][ T24] em28xx 3-1:0.0: Closing audio extension [ 370.189553][ T24] em28xx 3-1:0.0: Freeing device [ 370.489515][ T9736] sctp: [Deprecated]: syz.3.1045 (pid 9736) Use of struct sctp_assoc_value in delayed_ack socket option. [ 370.489515][ T9736] Use struct sctp_sack_info instead [ 370.807675][ T9742] IPv6: addrconf: prefix option has invalid lifetime [ 370.942012][ T9744] netlink: 308 bytes leftover after parsing attributes in process `syz.3.1048'. [ 370.952704][ T9744] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 370.960097][ T9744] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 370.967573][ T9744] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 371.136776][ T9746] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1049'. [ 371.433831][ T5918] usb 2-1: USB disconnect, device number 47 [ 371.831319][ T9750] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 371.843715][ T5918] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 371.912901][ T9] usb 1-1: USB disconnect, device number 71 [ 371.990026][ T5953] usb 5-1: USB disconnect, device number 46 [ 372.113628][ T9752] input: syz1 as /devices/virtual/input/input38 [ 372.145188][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 372.204022][ T5918] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 372.268318][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.317827][ T5918] usb 2-1: config 0 descriptor?? [ 372.353050][ T9759] bridge0: port 3(macsec1) entered blocking state [ 372.362808][ T9759] bridge0: port 3(macsec1) entered disabled state [ 372.383784][ T9759] macsec1: entered allmulticast mode [ 372.423765][ T9759] macsec1: left allmulticast mode [ 372.453986][ T9] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 372.577019][ T9765] sctp: [Deprecated]: syz.4.1057 (pid 9765) Use of struct sctp_assoc_value in delayed_ack socket option. [ 372.577019][ T9765] Use struct sctp_sack_info instead [ 372.613769][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 372.622333][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 183, changing to 11 [ 372.636676][ T9] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 372.654422][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 372.669980][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.678107][ T9] usb 4-1: Product: ꕲ뱒ৃ䧕㟲㜶潳˴浰久雭뉁䣂鋴 [ 372.688650][ T9] usb 4-1: Manufacturer: Љ [ 372.693207][ T9] usb 4-1: SerialNumber: ࠇ [ 372.907225][ T9] cdc_ncm 4-1:1.0: bind() failure [ 372.924565][ T9] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 372.931536][ T9] cdc_ncm 4-1:1.1: bind() failure [ 372.941746][ T9] usb 4-1: USB disconnect, device number 59 [ 373.181823][ T9781] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 373.266099][ T58] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 373.464806][ T58] usb 5-1: Using ep0 maxpacket: 16 [ 373.493354][ T58] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 373.539026][ T58] usb 5-1: config 0 has no interface number 0 [ 373.545738][ T58] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 373.564474][ T58] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 373.581702][ T58] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 373.591116][ T58] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 373.600983][ T58] usb 5-1: Product: syz [ 373.620797][ T58] usb 5-1: SerialNumber: syz [ 373.642049][ T58] usb 5-1: config 0 descriptor?? [ 373.700059][ T58] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 373.770792][ T58] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input39 [ 374.019702][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 374.023212][ T9] usb 5-1: USB disconnect, device number 47 [ 374.026659][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 374.057909][ T9] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 374.252204][ T9794] FAULT_INJECTION: forcing a failure. [ 374.252204][ T9794] name failslab, interval 1, probability 0, space 0, times 0 [ 374.266390][ T9794] CPU: 1 UID: 0 PID: 9794 Comm: syz.2.1066 Not tainted syzkaller #0 PREEMPT(full) [ 374.266414][ T9794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 374.266428][ T9794] Call Trace: [ 374.266435][ T9794] [ 374.266443][ T9794] dump_stack_lvl+0x189/0x250 [ 374.266474][ T9794] ? __pfx_dump_stack_lvl+0x10/0x10 [ 374.266515][ T9794] should_fail_ex+0x414/0x560 [ 374.266546][ T9794] should_failslab+0xa8/0x100 [ 374.266572][ T9794] kmem_cache_alloc_noprof+0x73/0x3c0 [ 374.266593][ T9794] ? sk_prot_alloc+0x57/0x220 [ 374.266619][ T9794] sk_prot_alloc+0x57/0x220 [ 374.266637][ T9794] ? sk_alloc+0x24/0x370 [ 374.266659][ T9794] sk_alloc+0x3a/0x370 [ 374.266684][ T9794] inet6_create+0x7f0/0x1260 [ 374.266705][ T9794] ? inet6_create+0x83/0x1260 [ 374.266733][ T9794] __sock_create+0x4b3/0x9f0 [ 374.266762][ T9794] mptcp_subflow_create_socket+0xfd/0xb40 [ 374.266794][ T9794] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 374.266817][ T9794] ? __lock_acquire+0xab9/0xd20 [ 374.266849][ T9794] __mptcp_nmpc_sk+0x148/0x760 [ 374.266874][ T9794] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 374.266894][ T9794] ? __local_bh_enable_ip+0x12d/0x1c0 [ 374.266912][ T9794] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.266932][ T9794] ? __local_bh_enable_ip+0x12d/0x1c0 [ 374.266952][ T9794] mptcp_sendmsg_fastopen+0xd4/0x580 [ 374.266982][ T9794] mptcp_sendmsg+0x176c/0x1970 [ 374.267001][ T9794] ? __pfx___might_resched+0x10/0x10 [ 374.267016][ T9794] ? __lock_acquire+0xab9/0xd20 [ 374.267063][ T9794] ? aa_sk_perm+0x81e/0x950 [ 374.267094][ T9794] ? __pfx_aa_sk_perm+0x10/0x10 [ 374.267118][ T9794] ? __pfx_mptcp_sendmsg+0x10/0x10 [ 374.267146][ T9794] ? inet6_sendmsg+0x101/0x120 [ 374.267169][ T9794] __sock_sendmsg+0xe5/0x270 [ 374.267197][ T9794] ____sys_sendmsg+0x505/0x830 [ 374.267225][ T9794] ? __pfx_____sys_sendmsg+0x10/0x10 [ 374.267256][ T9794] ? import_iovec+0x74/0xa0 [ 374.267282][ T9794] ___sys_sendmsg+0x21f/0x2a0 [ 374.267305][ T9794] ? __pfx____sys_sendmsg+0x10/0x10 [ 374.267366][ T9794] ? __fget_files+0x2a/0x420 [ 374.267381][ T9794] ? __fget_files+0x3a0/0x420 [ 374.267408][ T9794] __x64_sys_sendmsg+0x19b/0x260 [ 374.267432][ T9794] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 374.267463][ T9794] ? __pfx_ksys_write+0x10/0x10 [ 374.267482][ T9794] ? rcu_is_watching+0x15/0xb0 [ 374.267505][ T9794] ? do_syscall_64+0xbe/0x3b0 [ 374.267529][ T9794] do_syscall_64+0xfa/0x3b0 [ 374.267546][ T9794] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.267564][ T9794] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.267582][ T9794] ? clear_bhb_loop+0x60/0xb0 [ 374.267603][ T9794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.267625][ T9794] RIP: 0033:0x7f1e3e98eec9 [ 374.267641][ T9794] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 374.267655][ T9794] RSP: 002b:00007f1e3f816038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 374.267674][ T9794] RAX: ffffffffffffffda RBX: 00007f1e3ebe5fa0 RCX: 00007f1e3e98eec9 [ 374.267687][ T9794] RDX: 0000000020000001 RSI: 0000200000000780 RDI: 0000000000000003 [ 374.267699][ T9794] RBP: 00007f1e3f816090 R08: 0000000000000000 R09: 0000000000000000 [ 374.267710][ T9794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 374.267721][ T9794] R13: 00007f1e3ebe6038 R14: 00007f1e3ebe5fa0 R15: 00007f1e3ed0fa28 [ 374.267752][ T9794] [ 374.789425][ T5918] usbhid 2-1:0.0: can't add hid device: -71 [ 374.795628][ T5918] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 374.806126][ T5918] usb 2-1: USB disconnect, device number 48 [ 374.904749][ T9799] sctp: [Deprecated]: syz.4.1068 (pid 9799) Use of struct sctp_assoc_value in delayed_ack socket option. [ 374.904749][ T9799] Use struct sctp_sack_info instead [ 375.453535][ T5953] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 375.643786][ T9] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 375.710056][ T5953] usb 2-1: Using ep0 maxpacket: 16 [ 375.730320][ T5953] usb 2-1: config 2 has an invalid interface number: 4 but max is 0 [ 375.770382][ T5953] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 375.920217][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 375.954416][ T5953] usb 2-1: config 2 has no interface number 0 [ 375.978730][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 375.991009][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 376.013546][ T5953] usb 2-1: config 2 interface 4 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 376.085672][ T5953] usb 2-1: config 2 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 376.099917][ T9] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 376.111186][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.119390][ T5925] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 376.131267][ T5953] usb 2-1: New USB device found, idVendor=0499, idProduct=1018, bcdDevice=b2.da [ 376.184995][ T9] usb 1-1: config 0 descriptor?? [ 376.203654][ T5918] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 376.222089][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.243178][ T9] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 376.292531][ T5953] usb 2-1: Product: syz [ 376.324614][ T5953] usb 2-1: Manufacturer: syz [ 376.332174][ T5953] usb 2-1: SerialNumber: syz [ 376.365034][ T5918] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 376.438133][ T5925] usb 5-1: config 0 has no interfaces? [ 376.441772][ T5918] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 376.474721][ T5953] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 376.486722][ T5925] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 376.495966][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.508986][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.514522][ T5925] usb 5-1: Product: syz [ 376.524411][ T5925] usb 5-1: Manufacturer: syz [ 376.548016][ T5925] usb 5-1: SerialNumber: syz [ 376.618865][ T5918] usb 4-1: config 0 descriptor?? [ 376.719954][ T5925] usb 5-1: config 0 descriptor?? [ 376.727866][ T5953] snd-usb-audio 2-1:2.4: probe with driver snd-usb-audio failed with error -2 [ 376.841058][ T5918] usbhid 4-1:0.0: can't add hid device: -71 [ 376.859698][ T5918] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 376.909764][ T5918] usb 4-1: USB disconnect, device number 60 [ 377.149769][ T8522] udevd[8522]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:2.4/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 377.212330][ T5953] usb 2-1: USB disconnect, device number 49 [ 377.375810][ T5918] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 377.426870][ T9829] random: crng reseeded on system resumption [ 377.527105][ T9832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.536512][ T9832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 377.584405][ T5918] usb 4-1: Using ep0 maxpacket: 16 [ 377.636871][ T5918] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 377.675359][ T5918] usb 4-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 377.698752][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.712505][ T9829] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1071'. [ 377.751473][ T9829] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 377.761556][ T5918] usb 4-1: config 0 descriptor?? [ 378.250832][ T5918] kye 0003:0458:5016.0005: control desc unexpectedly large [ 378.327578][ T5918] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0005/input/input40 [ 378.400701][ T5918] input: HID 0458:5016 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5016.0005/input/input41 [ 378.554930][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.569364][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.791963][ T5918] kye 0003:0458:5016.0005: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.3-1/input0 [ 378.995574][ T5925] usb 5-1: USB disconnect, device number 48 [ 379.558369][ T5925] usb 1-1: USB disconnect, device number 72 [ 379.657931][ T9854] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1080'. [ 380.184470][ T5918] usb 4-1: USB disconnect, device number 61 [ 380.258281][ T9863] sctp: [Deprecated]: syz.0.1082 (pid 9863) Use of struct sctp_assoc_value in delayed_ack socket option. [ 380.258281][ T9863] Use struct sctp_sack_info instead [ 380.396308][ T9867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1084'. [ 380.653769][ T5918] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 380.846995][ T5918] usb 4-1: Using ep0 maxpacket: 16 [ 380.855989][ T5918] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 380.890802][ T5918] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 380.954355][ T5918] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 380.982142][ T5918] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.022759][ T5918] usb 4-1: Product: syz [ 381.037173][ T5918] usb 4-1: Manufacturer: syz [ 381.066394][ T5918] usb 4-1: SerialNumber: syz [ 381.104865][ T5918] usb 4-1: config 0 descriptor?? [ 381.211267][ T9876] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1088'. [ 381.211284][ T9876] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1088'. [ 381.280856][ T9879] vivid-000: ================= START STATUS ================= [ 381.280871][ T9879] vivid-000: Test Pattern: 75% Colorbar [ 381.280887][ T9879] vivid-000: Fill Percentage of Frame: 100 [ 381.280899][ T9879] vivid-000: Horizontal Movement: Move Right Slow [ 381.280911][ T9879] vivid-000: Vertical Movement: No Movement [ 381.280923][ T9879] vivid-000: OSD Text Mode: All [ 381.280934][ T9879] vivid-000: Show Border: false [ 381.280945][ T9879] vivid-000: Show Square: false [ 381.280955][ T9879] vivid-000: Sensor Flipped Horizontally: false [ 381.280966][ T9879] vivid-000: Sensor Flipped Vertically: false [ 381.280978][ T9879] vivid-000: Insert SAV Code in Image: false [ 381.280989][ T9879] vivid-000: Insert EAV Code in Image: false [ 381.281000][ T9879] vivid-000: Insert Video Guard Band: false [ 381.281011][ T9879] vivid-000: Reduced Framerate: false [ 381.281021][ T9879] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 381.281033][ T9879] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 381.281045][ T9879] vivid-000: Enable Capture Cropping: true grabbed [ 381.281059][ T9879] vivid-000: Enable Capture Composing: true grabbed [ 381.281073][ T9879] vivid-000: Enable Capture Scaler: true grabbed [ 381.281087][ T9879] vivid-000: Timestamp Source: End of Frame [ 381.281098][ T9879] vivid-000: Colorspace: SMPTE 170M [ 381.281109][ T9879] vivid-000: Transfer Function: Default [ 381.281120][ T9879] vivid-000: Y'CbCr Encoding: Default [ 381.281131][ T9879] vivid-000: HSV Encoding: Hue 0-179 [ 381.281142][ T9879] vivid-000: Quantization: Default [ 381.281152][ T9879] vivid-000: Apply Alpha To Red Only: false [ 381.281163][ T9879] vivid-000: Standard Aspect Ratio: 4x3 [ 381.281174][ T9879] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 381.281189][ T9879] vivid-000: DV Timings: 640x480p59 inactive [ 381.281203][ T9879] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 381.281214][ T9879] vivid-000: Maximum EDID Blocks: 2 [ 381.281225][ T9879] vivid-000: Limited RGB Range (16-235): false [ 381.281236][ T9879] vivid-000: Rx RGB Quantization Range: Automatic [ 381.281247][ T9879] vivid-000: Power Present: 0x00000001 [ 381.281260][ T9879] tpg source WxH: 720x576 (Y'CbCr) [ 381.281274][ T9879] tpg field: 4 [ 381.281279][ T9879] tpg crop: (0,8)/720x16 [ 381.281307][ T9879] tpg compose: (0,560)/180x16 [ 381.281314][ T9879] tpg colorspace: 1 [ 381.281319][ T9879] tpg transfer function: 0/1 [ 381.281324][ T9879] tpg Y'CbCr encoding: 0/1 [ 381.281329][ T9879] tpg quantization: 0/2 [ 381.281334][ T9879] tpg RGB range: 0/2 [ 381.281339][ T9879] vivid-000: ================== END STATUS ================== [ 382.830547][ T9916] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1098'. [ 383.267512][ T5918] usb 4-1: USB disconnect, device number 62 [ 383.646254][ T9933] netlink: 19 bytes leftover after parsing attributes in process `syz.2.1102'. [ 383.733978][ T5918] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 383.823569][ T9939] netlink: 'syz.2.1105': attribute type 2 has an invalid length. [ 383.928090][ T5918] usb 4-1: Using ep0 maxpacket: 32 [ 383.944804][ T5918] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 384.013597][ T5918] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 384.100741][ T5918] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 384.114969][ T5918] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.126848][ T9952] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1107'. [ 384.130328][ T5918] hub 4-1:4.0: USB hub found [ 384.474079][ T5918] hub 4-1:4.0: config failed, can't read hub descriptor (err -90) [ 384.691631][ T9926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.715729][ T9926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.738107][ T5918] usbhid 4-1:4.0: can't add hid device: -71 [ 384.744337][ T5918] usbhid 4-1:4.0: probe with driver usbhid failed with error -71 [ 384.884768][ T5918] usb 4-1: USB disconnect, device number 63 [ 385.113659][ T5925] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 385.280560][ T5925] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 385.288753][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 385.299224][ T5925] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 385.310049][ T5925] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 385.319252][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 385.328892][ T5925] usb 3-1: Product: syz [ 385.333137][ T5925] usb 3-1: Manufacturer: syz [ 385.337765][ T5925] usb 3-1: SerialNumber: syz [ 385.344424][ T5925] usb 3-1: config 0 descriptor?? [ 385.658434][ T5925] usb 3-1: cannot find UAC_HEADER [ 385.680023][ T5925] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 385.692700][ T5925] usb 3-1: USB disconnect, device number 67 [ 385.716087][ T8522] udevd[8522]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 439.966203][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.972553][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 482.908668][ T9995] netlink: 19 bytes leftover after parsing attributes in process `syz.3.1118'. [ 483.108071][ T58] usb 1-1: new full-speed USB device number 73 using dummy_hcd [ 483.366529][ T58] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 483.376995][ T58] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 483.398612][ T58] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 483.414873][ T58] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.426203][ T58] usb 1-1: Product: syz [ 483.431023][ T58] usb 1-1: Manufacturer: syz [ 483.435959][ T58] usb 1-1: SerialNumber: syz [ 483.803829][ T5953] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 483.968532][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 483.975486][ T58] usb 1-1: cannot find UAC_HEADER [ 483.986963][ T5953] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.012036][ T5953] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 484.076105][ T5953] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 484.098264][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.161625][ T5953] usb 4-1: config 0 descriptor?? [ 484.271014][ T5953] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 484.370718][ T58] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 484.404247][T10003] udevd[10003]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 484.420805][ T58] usb 1-1: USB disconnect, device number 73 [ 484.473695][ T9] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 484.607132][T10013] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1123'. [ 484.663474][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 484.676997][ T9] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 484.685996][ T9] usb 3-1: config 0 has no interface number 0 [ 484.692174][ T9] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 484.760537][ T9] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 484.801393][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.846266][ T9] usb 3-1: Product: syz [ 484.887711][ T9] usb 3-1: Manufacturer: syz [ 484.921502][ T9] usb 3-1: SerialNumber: syz [ 484.966640][ T9] usb 3-1: config 0 descriptor?? [ 484.982412][ T9] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 485.069685][ T9] em28xx 3-1:0.132: Video interface 132 found: isoc [ 485.230314][T10020] random: crng reseeded on system resumption [ 485.266865][T10020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.276981][T10020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.420727][T10022] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1120'. [ 485.438842][T10022] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 486.200127][ T9] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 486.339654][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 486.464541][ T9] em28xx 3-1:0.132: board has no eeprom [ 486.576890][ T9] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 486.624791][ T9] em28xx 3-1:0.132: analog set to isoc mode. [ 486.651203][ T5925] em28xx 3-1:0.132: Registering V4L2 extension [ 486.803271][ T9] usb 4-1: USB disconnect, device number 64 [ 486.824849][ T919] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 486.826432][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 486.916826][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 486.958082][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 486.971979][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 487.045273][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 487.053492][ T919] usb 2-1: Using ep0 maxpacket: 32 [ 487.062744][ T919] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 487.064339][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 487.087414][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 487.101805][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 487.120805][ T919] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 487.176196][ T919] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 487.196430][ T919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.230183][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc0 (error=-5) [ 487.231037][ T919] hub 2-1:4.0: USB hub found [ 487.246017][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc2 (error=-5) [ 487.261295][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc4 (error=-5) [ 487.272503][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc6 (error=-5) [ 487.309487][ T5925] em28xx 3-1:0.132: failed to trigger read from i2c address 0xc8 (error=-5) [ 487.329261][ T5925] em28xx 3-1:0.132: Config register raw data: 0xfffffffb [ 487.344354][ T5925] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 487.380657][ T5925] em28xx 3-1:0.132: No AC97 audio processor [ 487.397729][T10034] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1127'. [ 487.432191][ T919] hub 2-1:4.0: config failed, can't read hub descriptor (err -90) [ 487.475598][ T5925] usb 3-1: Decoder not found [ 487.685015][T10024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.694044][T10024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.718083][ T919] usbhid 2-1:4.0: can't add hid device: -71 [ 487.724249][ T919] usbhid 2-1:4.0: probe with driver usbhid failed with error -71 [ 487.748843][ T5925] em28xx 3-1:0.132: failed to create media graph [ 487.758244][ T919] usb 2-1: USB disconnect, device number 50 [ 487.780124][ T5925] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 487.800356][ T5925] em28xx 3-1:0.132: Remote control support is not available for this card. [ 487.801070][T10037] ================================================================== [ 487.817085][T10037] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 487.824446][T10037] Read of size 8 at addr ffff88802f1ec740 by task v4l_id/10037 [ 487.831966][T10037] [ 487.834276][T10037] CPU: 1 UID: 0 PID: 10037 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 487.834294][T10037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 487.834303][T10037] Call Trace: [ 487.834309][T10037] [ 487.834315][T10037] dump_stack_lvl+0x189/0x250 [ 487.834333][T10037] ? rcu_is_watching+0x15/0xb0 [ 487.834347][T10037] ? __kasan_check_byte+0x12/0x40 [ 487.834367][T10037] ? __pfx_dump_stack_lvl+0x10/0x10 [ 487.834381][T10037] ? rcu_is_watching+0x15/0xb0 [ 487.834394][T10037] ? lock_release+0x4b/0x3e0 [ 487.834415][T10037] ? __virt_addr_valid+0x1c8/0x5c0 [ 487.834432][T10037] ? __virt_addr_valid+0x4a5/0x5c0 [ 487.834449][T10037] print_report+0xca/0x240 [ 487.834462][T10037] ? v4l2_fh_open+0xc7/0x430 [ 487.834475][T10037] kasan_report+0x118/0x150 [ 487.834494][T10037] ? v4l2_fh_open+0xc7/0x430 [ 487.834510][T10037] v4l2_fh_open+0xc7/0x430 [ 487.834526][T10037] em28xx_v4l2_open+0x157/0x9a0 [ 487.834554][T10037] v4l2_open+0x20f/0x360 [ 487.834570][T10037] chrdev_open+0x4cc/0x5e0 [ 487.834583][T10037] ? __pfx_chrdev_open+0x10/0x10 [ 487.834595][T10037] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 487.834618][T10037] ? __pfx_chrdev_open+0x10/0x10 [ 487.834629][T10037] do_dentry_open+0x953/0x13f0 [ 487.834648][T10037] vfs_open+0x3b/0x340 [ 487.834660][T10037] ? path_openat+0x2ecd/0x3830 [ 487.834678][T10037] path_openat+0x2ee5/0x3830 [ 487.834692][T10037] ? arch_stack_walk+0xfc/0x150 [ 487.834714][T10037] ? stack_depot_save_flags+0x40/0x860 [ 487.834740][T10037] ? __pfx_path_openat+0x10/0x10 [ 487.834754][T10037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.834774][T10037] do_filp_open+0x1fa/0x410 [ 487.834789][T10037] ? __lock_acquire+0xab9/0xd20 [ 487.834808][T10037] ? __pfx_do_filp_open+0x10/0x10 [ 487.834831][T10037] ? _raw_spin_unlock+0x28/0x50 [ 487.834844][T10037] ? alloc_fd+0x64c/0x6c0 [ 487.834866][T10037] do_sys_openat2+0x121/0x1c0 [ 487.834881][T10037] ? __pfx_do_sys_openat2+0x10/0x10 [ 487.834895][T10037] ? exc_page_fault+0x76/0xf0 [ 487.834909][T10037] ? do_user_addr_fault+0xc8a/0x1390 [ 487.834923][T10037] __x64_sys_openat+0x138/0x170 [ 487.834940][T10037] do_syscall_64+0xfa/0x3b0 [ 487.834954][T10037] ? lockdep_hardirqs_on+0x9c/0x150 [ 487.834968][T10037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.834981][T10037] ? clear_bhb_loop+0x60/0xb0 [ 487.834996][T10037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.835009][T10037] RIP: 0033:0x7ff0462a7407 [ 487.835023][T10037] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 487.835036][T10037] RSP: 002b:00007ffd88fff390 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 487.835051][T10037] RAX: ffffffffffffffda RBX: 00007ff046a99880 RCX: 00007ff0462a7407 [ 487.835062][T10037] RDX: 0000000000000000 RSI: 00007ffd89000f1b RDI: ffffffffffffff9c [ 487.835071][T10037] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 487.835080][T10037] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 487.835088][T10037] R13: 00007ffd88fff5e0 R14: 00007ff046c00000 R15: 0000562fdd9fa4d8 [ 487.835104][T10037] [ 487.835109][T10037] [ 488.141732][T10037] Allocated by task 5925: [ 488.146039][T10037] kasan_save_track+0x3e/0x80 [ 488.150706][T10037] __kasan_kmalloc+0x93/0xb0 [ 488.155281][T10037] __kmalloc_cache_noprof+0x230/0x3d0 [ 488.160642][T10037] em28xx_v4l2_init+0x10b/0x2e70 [ 488.165563][T10037] em28xx_init_extension+0x120/0x1c0 [ 488.170831][T10037] process_scheduled_works+0xade/0x17b0 [ 488.176356][T10037] worker_thread+0x8a0/0xda0 [ 488.180925][T10037] kthread+0x711/0x8a0 [ 488.184979][T10037] ret_from_fork+0x439/0x7d0 [ 488.189549][T10037] ret_from_fork_asm+0x1a/0x30 [ 488.194295][T10037] [ 488.196598][T10037] Freed by task 5925: [ 488.200552][T10037] kasan_save_track+0x3e/0x80 [ 488.205211][T10037] kasan_save_free_info+0x46/0x50 [ 488.210216][T10037] __kasan_slab_free+0x5b/0x80 [ 488.214964][T10037] kfree+0x18e/0x440 [ 488.218841][T10037] em28xx_v4l2_init+0x1683/0x2e70 [ 488.223849][T10037] em28xx_init_extension+0x120/0x1c0 [ 488.229116][T10037] process_scheduled_works+0xade/0x17b0 [ 488.234642][T10037] worker_thread+0x8a0/0xda0 [ 488.239210][T10037] kthread+0x711/0x8a0 [ 488.243261][T10037] ret_from_fork+0x439/0x7d0 [ 488.247836][T10037] ret_from_fork_asm+0x1a/0x30 [ 488.252587][T10037] [ 488.254893][T10037] The buggy address belongs to the object at ffff88802f1ec000 [ 488.254893][T10037] which belongs to the cache kmalloc-8k of size 8192 [ 488.268928][T10037] The buggy address is located 1856 bytes inside of [ 488.268928][T10037] freed 8192-byte region [ffff88802f1ec000, ffff88802f1ee000) [ 488.282876][T10037] [ 488.285181][T10037] The buggy address belongs to the physical page: [ 488.291586][T10037] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f1e8 [ 488.300422][T10037] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 488.309071][T10037] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 488.316605][T10037] page_type: f5(slab) [ 488.320570][T10037] raw: 00fff00000000040 ffff88801a442280 ffffea00008aa400 dead000000000004 [ 488.329131][T10037] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 488.337694][T10037] head: 00fff00000000040 ffff88801a442280 ffffea00008aa400 dead000000000004 [ 488.346346][T10037] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 488.354997][T10037] head: 00fff00000000003 ffffea0000bc7a01 00000000ffffffff 00000000ffffffff [ 488.363647][T10037] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 488.372294][T10037] page dumped because: kasan: bad access detected [ 488.378693][T10037] page_owner tracks the page as allocated [ 488.384383][T10037] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8627, tgid 8626 (syz.1.723), ts 289645811609, free_ts 289598535051 [ 488.405632][T10037] post_alloc_hook+0x240/0x2a0 [ 488.410386][T10037] get_page_from_freelist+0x21e4/0x22c0 [ 488.415910][T10037] __alloc_frozen_pages_noprof+0x181/0x370 [ 488.421700][T10037] alloc_pages_mpol+0x232/0x4a0 [ 488.426539][T10037] allocate_slab+0x8a/0x370 [ 488.431023][T10037] ___slab_alloc+0xbeb/0x1420 [ 488.435690][T10037] __kmalloc_cache_noprof+0x296/0x3d0 [ 488.441045][T10037] audit_log_d_path+0xb5/0x190 [ 488.445793][T10037] audit_log_d_path_exe+0x42/0x70 [ 488.450800][T10037] audit_log_task+0x2b3/0x3c0 [ 488.455484][T10037] audit_seccomp+0x86/0x190 [ 488.459969][T10037] __seccomp_filter+0x9aa/0x1a40 [ 488.464885][T10037] syscall_trace_enter+0xaa/0x160 [ 488.469897][T10037] do_syscall_64+0xd3/0x3b0 [ 488.474380][T10037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.480251][T10037] page last free pid 8522 tgid 8522 stack trace: [ 488.486551][T10037] __free_frozen_pages+0xbc4/0xd30 [ 488.491655][T10037] __put_partials+0x156/0x1a0 [ 488.496314][T10037] put_cpu_partial+0x17c/0x250 [ 488.501058][T10037] __slab_free+0x2d5/0x3c0 [ 488.505457][T10037] qlist_free_all+0x97/0x140 [ 488.510031][T10037] kasan_quarantine_reduce+0x148/0x160 [ 488.515471][T10037] __kasan_slab_alloc+0x22/0x80 [ 488.520309][T10037] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 488.525751][T10037] getname_flags+0xb8/0x540 [ 488.530234][T10037] __x64_sys_rename+0x5d/0x90 [ 488.534899][T10037] do_syscall_64+0xfa/0x3b0 [ 488.539385][T10037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.545257][T10037] [ 488.547560][T10037] Memory state around the buggy address: [ 488.553167][T10037] ffff88802f1ec600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 488.561208][T10037] ffff88802f1ec680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 488.569258][T10037] >ffff88802f1ec700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 488.577297][T10037] ^ [ 488.583424][T10037] ffff88802f1ec780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 488.591464][T10037] ffff88802f1ec800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 488.599504][T10037] ================================================================== [ 488.684291][ T58] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 488.715884][T10037] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 488.723106][T10037] CPU: 1 UID: 0 PID: 10037 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 488.732128][T10037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 488.742178][T10037] Call Trace: [ 488.745438][T10037] [ 488.748348][T10037] dump_stack_lvl+0x99/0x250 [ 488.752914][T10037] ? __asan_memcpy+0x40/0x70 [ 488.757479][T10037] ? __pfx_dump_stack_lvl+0x10/0x10 [ 488.762657][T10037] ? __pfx__printk+0x10/0x10 [ 488.767238][T10037] vpanic+0x281/0x750 [ 488.771195][T10037] ? preempt_schedule+0xae/0xc0 [ 488.776021][T10037] ? __pfx_vpanic+0x10/0x10 [ 488.780499][T10037] ? preempt_schedule_common+0x83/0xd0 [ 488.785932][T10037] ? preempt_schedule+0xae/0xc0 [ 488.790756][T10037] ? __pfx_preempt_schedule+0x10/0x10 [ 488.796101][T10037] panic+0xb9/0xc0 [ 488.799824][T10037] ? __pfx_panic+0x10/0x10 [ 488.804234][T10037] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 488.810102][T10037] ? v4l2_fh_open+0xc7/0x430 [ 488.814681][T10037] check_panic_on_warn+0x89/0xb0 [ 488.819594][T10037] ? v4l2_fh_open+0xc7/0x430 [ 488.824162][T10037] end_report+0x78/0x160 [ 488.828386][T10037] kasan_report+0x129/0x150 [ 488.832868][T10037] ? v4l2_fh_open+0xc7/0x430 [ 488.837435][T10037] v4l2_fh_open+0xc7/0x430 [ 488.841826][T10037] em28xx_v4l2_open+0x157/0x9a0 [ 488.846659][T10037] v4l2_open+0x20f/0x360 [ 488.850877][T10037] chrdev_open+0x4cc/0x5e0 [ 488.855265][T10037] ? __pfx_chrdev_open+0x10/0x10 [ 488.860278][T10037] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 488.866592][T10037] ? __pfx_chrdev_open+0x10/0x10 [ 488.871502][T10037] do_dentry_open+0x953/0x13f0 [ 488.876244][T10037] vfs_open+0x3b/0x340 [ 488.880289][T10037] ? path_openat+0x2ecd/0x3830 [ 488.885027][T10037] path_openat+0x2ee5/0x3830 [ 488.889591][T10037] ? arch_stack_walk+0xfc/0x150 [ 488.894421][T10037] ? stack_depot_save_flags+0x40/0x860 [ 488.899862][T10037] ? __pfx_path_openat+0x10/0x10 [ 488.904791][T10037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.910833][T10037] do_filp_open+0x1fa/0x410 [ 488.915310][T10037] ? __lock_acquire+0xab9/0xd20 [ 488.920139][T10037] ? __pfx_do_filp_open+0x10/0x10 [ 488.925143][T10037] ? _raw_spin_unlock+0x28/0x50 [ 488.929966][T10037] ? alloc_fd+0x64c/0x6c0 [ 488.934273][T10037] do_sys_openat2+0x121/0x1c0 [ 488.938927][T10037] ? __pfx_do_sys_openat2+0x10/0x10 [ 488.944096][T10037] ? exc_page_fault+0x76/0xf0 [ 488.948745][T10037] ? do_user_addr_fault+0xc8a/0x1390 [ 488.954002][T10037] __x64_sys_openat+0x138/0x170 [ 488.958829][T10037] do_syscall_64+0xfa/0x3b0 [ 488.963308][T10037] ? lockdep_hardirqs_on+0x9c/0x150 [ 488.968549][T10037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.974592][T10037] ? clear_bhb_loop+0x60/0xb0 [ 488.979247][T10037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.985122][T10037] RIP: 0033:0x7ff0462a7407 [ 488.989512][T10037] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 489.009097][T10037] RSP: 002b:00007ffd88fff390 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 489.017496][T10037] RAX: ffffffffffffffda RBX: 00007ff046a99880 RCX: 00007ff0462a7407 [ 489.025452][T10037] RDX: 0000000000000000 RSI: 00007ffd89000f1b RDI: ffffffffffffff9c [ 489.033406][T10037] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 489.041378][T10037] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 489.049329][T10037] R13: 00007ffd88fff5e0 R14: 00007ff046c00000 R15: 0000562fdd9fa4d8 [ 489.057283][T10037] [ 489.060555][T10037] Kernel Offset: disabled [ 489.064865][T10037] Rebooting in 86400 seconds..