, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 966.241595][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.261841][T12487] usb 4-1: Product: syz [ 966.268415][T12487] usb 4-1: Manufacturer: syz [ 966.273097][T12487] usb 4-1: SerialNumber: syz [ 966.312515][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:06:51 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 966.461846][T23314] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 966.468809][T23314] ath9k_htc: Failed to initialize the device [ 966.476589][ T3704] usb 3-1: ath9k_htc: USB layer deinitialized 23:06:51 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 966.621913][ T3670] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 966.629320][ T3670] ath9k_htc: Failed to initialize the device [ 966.641544][T11605] usb 2-1: ath9k_htc: USB layer deinitialized 23:06:51 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 966.781889][ T55] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 966.788987][ T55] ath9k_htc: Failed to initialize the device [ 966.800641][ T9028] usb 5-1: ath9k_htc: USB layer deinitialized [ 966.841912][ T3704] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 966.861858][ T9328] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 966.868991][ T9328] ath9k_htc: Failed to initialize the device [ 966.881241][T11615] usb 6-1: ath9k_htc: USB layer deinitialized [ 966.881842][T12487] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 967.031889][ T5] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 967.038993][T11605] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 967.046753][ T5] ath9k_htc: Failed to initialize the device [ 967.061808][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 967.100276][ T7] usb 4-1: USB disconnect, device number 61 [ 967.201837][ T9028] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 967.251834][T11615] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 967.432771][ T3704] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 967.441853][T11729] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 967.449635][ T3704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.466412][ T3704] usb 3-1: Product: syz [ 967.470667][ T3704] usb 3-1: Manufacturer: syz [ 967.481768][ T3704] usb 3-1: SerialNumber: syz [ 967.532282][ T3704] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:06:52 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 967.653225][T11605] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 967.666981][T11605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.675108][T11605] usb 2-1: Product: syz [ 967.681310][T11605] usb 2-1: Manufacturer: syz [ 967.686399][T11605] usb 2-1: SerialNumber: syz [ 967.732136][T11605] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 967.791814][ T9028] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 967.800926][T11615] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 967.811187][ T9028] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.819602][T11615] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.827840][T11615] usb 6-1: Product: syz [ 967.832417][T11615] usb 6-1: Manufacturer: syz [ 967.838059][ T9028] usb 5-1: Product: syz [ 967.842469][ T9028] usb 5-1: Manufacturer: syz [ 967.847609][T11615] usb 6-1: SerialNumber: syz [ 967.852612][ T9028] usb 5-1: SerialNumber: syz [ 967.892860][T11615] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 967.902116][ T9028] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 967.981860][T12487] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 967.988767][T12487] ath9k_htc: Failed to initialize the device [ 967.994875][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 968.041821][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 968.051291][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.061658][T11729] usb 1-1: Product: syz [ 968.067219][T11729] usb 1-1: Manufacturer: syz [ 968.072155][T11729] usb 1-1: SerialNumber: syz [ 968.112866][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 968.211847][ T3704] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 968.361855][ T7] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 968.381899][T11605] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 968.414132][ T55] usb 3-1: USB disconnect, device number 87 [ 968.561935][ T9328] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 968.571517][T11615] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 968.585505][ T3670] usb 2-1: USB disconnect, device number 60 [ 968.741844][T11729] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 968.765648][ T17] usb 5-1: USB disconnect, device number 72 [ 968.766951][ T5] usb 6-1: USB disconnect, device number 58 23:06:54 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 968.911890][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 968.929758][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.948273][ T7] usb 4-1: Product: syz [ 968.956401][ T7] usb 4-1: Manufacturer: syz [ 968.961004][ T7] usb 4-1: SerialNumber: syz [ 968.976729][T11671] usb 1-1: USB disconnect, device number 62 [ 969.022498][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:06:54 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:06:54 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) 23:06:54 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 969.261727][ T3704] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 969.268998][ T3704] ath9k_htc: Failed to initialize the device [ 969.313750][ T55] usb 3-1: ath9k_htc: USB layer deinitialized 23:06:54 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 969.421726][T11605] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 969.428706][T11605] ath9k_htc: Failed to initialize the device [ 969.441106][ T3670] usb 2-1: ath9k_htc: USB layer deinitialized [ 969.581703][ T9328] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 969.588812][ T9328] ath9k_htc: Failed to initialize the device [ 969.600097][ T17] usb 5-1: ath9k_htc: USB layer deinitialized [ 969.671670][ T55] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 969.671749][T11615] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 969.686883][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 969.697803][T11615] ath9k_htc: Failed to initialize the device [ 969.704828][ T5] usb 6-1: ath9k_htc: USB layer deinitialized [ 969.801679][ T3670] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 969.821740][T11729] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 969.828736][T11729] ath9k_htc: Failed to initialize the device [ 969.840983][T11671] usb 1-1: ath9k_htc: USB layer deinitialized [ 969.882390][T23314] usb 4-1: USB disconnect, device number 62 [ 969.951776][ T17] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 970.091773][ T5] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 970.191689][ T55] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 970.201095][ T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.209654][ T55] usb 3-1: Product: syz [ 970.214589][ T55] usb 3-1: Manufacturer: syz [ 970.220590][ T55] usb 3-1: SerialNumber: syz [ 970.251692][T11671] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 970.263758][ T55] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 970.321691][ T3670] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 970.331186][ T3670] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.340607][ T3670] usb 2-1: Product: syz [ 970.347456][ T3670] usb 2-1: Manufacturer: syz [ 970.352688][ T3670] usb 2-1: SerialNumber: syz 23:06:55 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 970.391996][ T3670] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 970.471675][ T17] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 970.480940][ T17] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.492439][ T17] usb 5-1: Product: syz [ 970.497981][ T17] usb 5-1: Manufacturer: syz [ 970.503428][ T17] usb 5-1: SerialNumber: syz [ 970.542156][ T17] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 970.661711][ T5] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 970.671138][ T5] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.682248][ T5] usb 6-1: Product: syz [ 970.687484][ T5] usb 6-1: Manufacturer: syz [ 970.692793][ T5] usb 6-1: SerialNumber: syz [ 970.704620][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 970.712539][ T7] ath9k_htc: Failed to initialize the device [ 970.718996][T23314] usb 4-1: ath9k_htc: USB layer deinitialized [ 970.742180][ T5] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 970.831659][ T55] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 970.831663][T11671] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 970.850772][T11671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.858902][T11671] usb 1-1: Product: syz [ 970.863561][T11671] usb 1-1: Manufacturer: syz [ 970.868706][T11671] usb 1-1: SerialNumber: syz [ 970.922941][T11671] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 970.971683][ T3670] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 971.042781][T11615] usb 3-1: USB disconnect, device number 88 [ 971.081653][T23314] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 971.112022][ T9760] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 971.183488][T11729] usb 2-1: USB disconnect, device number 61 [ 971.313773][T12487] usb 5-1: USB disconnect, device number 73 [ 971.421637][ T5] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:06:56 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 971.601938][T11671] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:06:56 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 971.671755][T23314] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 971.680944][T23314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.695436][T23314] usb 4-1: Product: syz [ 971.699655][T23314] usb 4-1: Manufacturer: syz [ 971.710982][T23314] usb 4-1: SerialNumber: syz [ 971.752345][T23314] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:06:57 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 971.806495][ T9328] usb 1-1: USB disconnect, device number 63 [ 971.901591][ T55] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 971.908671][ T55] ath9k_htc: Failed to initialize the device [ 971.920748][T11615] usb 3-1: ath9k_htc: USB layer deinitialized [ 971.981631][ T3670] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 971.990110][ T3670] ath9k_htc: Failed to initialize the device [ 972.002577][T11729] usb 2-1: ath9k_htc: USB layer deinitialized [ 972.141588][ T9760] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 972.148535][ T9760] ath9k_htc: Failed to initialize the device [ 972.160663][T12487] usb 5-1: ath9k_htc: USB layer deinitialized 23:06:57 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 972.281546][T11615] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 972.381599][T11729] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 972.411961][T23314] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 972.461590][ T5] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 972.468812][ T5] ath9k_htc: Failed to initialize the device [ 972.521484][T12487] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 972.614144][ T7] usb 4-1: USB disconnect, device number 63 [ 972.630868][T11671] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 972.637930][T11671] ath9k_htc: Failed to initialize the device [ 972.642748][ T17] usb 6-1: USB disconnect, device number 59 [ 972.650913][ T17] usb 6-1: ath9k_htc: USB layer deinitialized 23:06:57 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 972.661865][ T9328] usb 1-1: ath9k_htc: USB layer deinitialized [ 972.861833][T11615] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 972.871207][T11615] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 972.886529][T11615] usb 3-1: Product: syz [ 972.890878][T11615] usb 3-1: Manufacturer: syz [ 972.900736][T11615] usb 3-1: SerialNumber: syz [ 972.951556][T11729] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 972.961270][T11615] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 972.971173][T11729] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 972.982439][T11729] usb 2-1: Product: syz [ 972.986614][T11729] usb 2-1: Manufacturer: syz [ 972.991948][T11729] usb 2-1: SerialNumber: syz [ 973.031830][T11729] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 973.040422][ T9328] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 973.041474][T12487] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 973.058559][T12487] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.067627][T12487] usb 5-1: Product: syz [ 973.074093][T12487] usb 5-1: Manufacturer: syz [ 973.085315][T12487] usb 5-1: SerialNumber: syz 23:06:58 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 973.121661][ T17] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 973.131781][T12487] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 973.501492][T23314] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 973.509197][T23314] ath9k_htc: Failed to initialize the device [ 973.521818][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 973.631482][ T9328] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 973.640914][T11615] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 973.641429][ T17] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 973.651114][ T9328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.661254][ T17] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.676509][ T17] usb 6-1: Product: syz [ 973.680935][ T17] usb 6-1: Manufacturer: syz [ 973.681363][T11729] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 973.685658][ T17] usb 6-1: SerialNumber: syz [ 973.701122][ T9328] usb 1-1: Product: syz [ 973.707932][ T9328] usb 1-1: Manufacturer: syz [ 973.714096][ T9328] usb 1-1: SerialNumber: syz [ 973.734004][T12487] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 973.743585][ T17] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 973.762153][ T9328] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 973.841434][T11671] usb 3-1: USB disconnect, device number 89 [ 973.883666][ T5] usb 2-1: USB disconnect, device number 62 [ 973.891991][ T7] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 973.935089][T11605] usb 5-1: USB disconnect, device number 74 23:06:59 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 974.311322][ T17] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:06:59 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 974.381309][ T9328] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:06:59 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 974.501338][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 974.510529][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.523209][ T7] usb 4-1: Product: syz [ 974.528523][ T7] usb 4-1: Manufacturer: syz [ 974.533482][ T7] usb 4-1: SerialNumber: syz [ 974.571602][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 974.591067][ T9760] usb 1-1: USB disconnect, device number 64 [ 974.711267][T11615] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 974.719275][T11615] ath9k_htc: Failed to initialize the device [ 974.730939][T11671] usb 3-1: ath9k_htc: USB layer deinitialized [ 974.781233][T12487] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 974.781237][T11729] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 974.781260][T12487] ath9k_htc: Failed to initialize the device [ 974.788242][T11729] ath9k_htc: Failed to initialize the device [ 974.808366][T11605] usb 5-1: ath9k_htc: USB layer deinitialized [ 974.821458][ T5] usb 2-1: ath9k_htc: USB layer deinitialized 23:07:00 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 975.121214][T11671] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 975.161235][T11605] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 975.191193][ T5] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 975.211497][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 975.341159][ T17] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 975.348128][ T17] ath9k_htc: Failed to initialize the device [ 975.413652][T23314] usb 4-1: USB disconnect, device number 64 [ 975.431753][ T9328] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 975.439651][ T9328] ath9k_htc: Failed to initialize the device [ 975.451751][ T9760] usb 1-1: ath9k_htc: USB layer deinitialized 23:07:00 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 975.681189][T11671] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 975.690240][T11671] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.698540][ T3670] usb 6-1: USB disconnect, device number 60 [ 975.714994][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized [ 975.727872][T11671] usb 3-1: Product: syz [ 975.732420][ T5] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 975.741468][T11605] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 975.754867][ T5] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.762938][T11671] usb 3-1: Manufacturer: syz [ 975.767884][T11671] usb 3-1: SerialNumber: syz [ 975.774709][T11605] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.782837][ T5] usb 2-1: Product: syz [ 975.786990][ T5] usb 2-1: Manufacturer: syz [ 975.798080][T11605] usb 5-1: Product: syz [ 975.805651][T11605] usb 5-1: Manufacturer: syz [ 975.810311][T11605] usb 5-1: SerialNumber: syz [ 975.812542][ T9760] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 975.821804][ T5] usb 2-1: SerialNumber: syz 23:07:01 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 975.852537][T11671] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 975.872992][ T5] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 975.881358][T11605] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 976.171065][ T3670] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 976.221043][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 976.228769][ T7] ath9k_htc: Failed to initialize the device [ 976.236540][T23314] usb 4-1: ath9k_htc: USB layer deinitialized [ 976.341032][ T9760] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 976.350264][ T9760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.359990][ T9760] usb 1-1: Product: syz [ 976.365487][ T9760] usb 1-1: Manufacturer: syz [ 976.371836][ T9760] usb 1-1: SerialNumber: syz [ 976.411304][ T9760] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 976.491045][T11671] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 976.541123][T11729] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 976.550171][ T5] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 976.591145][T23314] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 976.690992][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 976.701350][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.703541][T11605] usb 3-1: USB disconnect, device number 90 [ 976.709502][ T3670] usb 6-1: Product: syz [ 976.720704][ T3670] usb 6-1: Manufacturer: syz [ 976.725749][ T3670] usb 6-1: SerialNumber: syz [ 976.745745][T12487] usb 2-1: USB disconnect, device number 63 [ 976.754890][ T55] usb 5-1: USB disconnect, device number 75 [ 976.771588][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 976.970953][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 977.160929][T23314] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 977.170117][T23314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 977.182719][T23314] usb 4-1: Product: syz [ 977.198026][T23314] usb 4-1: Manufacturer: syz 23:07:02 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 977.210896][T23314] usb 4-1: SerialNumber: syz [ 977.218670][ T9328] usb 1-1: USB disconnect, device number 65 23:07:02 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) 23:07:02 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 977.271225][T23314] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 977.352537][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 977.500876][T11671] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 977.508023][T11671] ath9k_htc: Failed to initialize the device [ 977.519518][T11605] usb 3-1: ath9k_htc: USB layer deinitialized [ 977.590899][T11729] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 977.597992][ T5] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 977.604988][T11729] ath9k_htc: Failed to initialize the device [ 977.620070][ T5] ath9k_htc: Failed to initialize the device [ 977.629176][ T55] usb 5-1: ath9k_htc: USB layer deinitialized [ 977.635378][T12487] usb 2-1: ath9k_htc: USB layer deinitialized 23:07:02 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 977.910813][T11605] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 977.931069][T23314] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 977.980864][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 977.988064][ T9760] ath9k_htc: Failed to initialize the device [ 977.999946][ T55] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 978.007648][T12487] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 978.015239][ T9328] usb 1-1: ath9k_htc: USB layer deinitialized [ 978.133013][T11790] usb 4-1: USB disconnect, device number 65 [ 978.380739][ T9328] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 978.380844][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 978.399262][ T3670] ath9k_htc: Failed to initialize the device [ 978.491027][T11605] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 978.500243][T11605] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.509946][T11605] usb 3-1: Product: syz [ 978.516263][T11605] usb 3-1: Manufacturer: syz [ 978.521188][T11605] usb 3-1: SerialNumber: syz [ 978.530966][ T55] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 978.540350][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 978.549988][ T55] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.558152][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.566469][ T55] usb 5-1: Product: syz [ 978.570622][ T55] usb 5-1: Manufacturer: syz [ 978.571153][T11605] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 978.575332][T12487] usb 2-1: Product: syz [ 978.588303][ T55] usb 5-1: SerialNumber: syz [ 978.593654][T12487] usb 2-1: Manufacturer: syz [ 978.599424][T12487] usb 2-1: SerialNumber: syz 23:07:03 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 978.653796][ T55] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 978.671196][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:04 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 978.742605][ T17] usb 6-1: USB disconnect, device number 61 [ 978.761568][ T17] usb 6-1: ath9k_htc: USB layer deinitialized [ 978.940681][T23314] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 978.947662][T23314] ath9k_htc: Failed to initialize the device [ 978.959130][T11790] usb 4-1: ath9k_htc: USB layer deinitialized [ 979.000707][ T9328] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 979.009827][ T9328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.019595][ T9328] usb 1-1: Product: syz [ 979.026003][ T9328] usb 1-1: Manufacturer: syz [ 979.033380][ T9328] usb 1-1: SerialNumber: syz [ 979.070928][ T9328] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 979.220662][ T17] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 979.220732][T11605] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 979.241705][T12487] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 979.250853][ T55] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 979.320635][T11790] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 979.431195][ T5] usb 3-1: USB disconnect, device number 91 [ 979.447651][T11729] usb 5-1: USB disconnect, device number 76 [ 979.463427][T11671] usb 2-1: USB disconnect, device number 64 [ 979.750602][ T17] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 979.759706][ T17] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.773473][ T17] usb 6-1: Product: syz [ 979.777625][ T17] usb 6-1: Manufacturer: syz [ 979.788442][ T17] usb 6-1: SerialNumber: syz [ 979.801802][ T9328] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 979.831200][ T17] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 979.853123][T11790] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 979.862914][T11790] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.873666][T11790] usb 4-1: Product: syz [ 979.878143][T11790] usb 4-1: Manufacturer: syz [ 979.884824][T11790] usb 4-1: SerialNumber: syz 23:07:05 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:05 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:07:05 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 979.930821][T11790] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 980.005078][T23314] usb 1-1: USB disconnect, device number 66 [ 980.300493][T11605] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 980.300778][T12487] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 980.307591][T11605] ath9k_htc: Failed to initialize the device [ 980.314375][ T55] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 980.331156][ T55] ath9k_htc: Failed to initialize the device [ 980.331943][ T5] usb 3-1: ath9k_htc: USB layer deinitialized [ 980.337419][T12487] ath9k_htc: Failed to initialize the device [ 980.354439][T11671] usb 2-1: ath9k_htc: USB layer deinitialized [ 980.360609][T11729] usb 5-1: ath9k_htc: USB layer deinitialized [ 980.430538][ T17] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:05 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 980.510504][T11790] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 980.721963][ T5] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 980.729705][ T7] usb 4-1: USB disconnect, device number 66 [ 980.735703][T11671] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 980.748451][T11729] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 980.860439][ T9328] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 980.867630][ T9328] ath9k_htc: Failed to initialize the device [ 980.875582][T23314] usb 1-1: ath9k_htc: USB layer deinitialized 23:07:06 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 981.240412][T23314] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 981.292142][ T5] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 981.301445][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.309463][ T5] usb 3-1: Product: syz [ 981.315807][T11671] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 981.326725][T11729] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 981.335791][ T5] usb 3-1: Manufacturer: syz [ 981.340424][T11729] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.348851][T11729] usb 5-1: Product: syz [ 981.354152][T11671] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.362314][ T5] usb 3-1: SerialNumber: syz [ 981.367243][T11671] usb 2-1: Product: syz [ 981.371783][T11729] usb 5-1: Manufacturer: syz [ 981.376364][T11729] usb 5-1: SerialNumber: syz [ 981.381267][T11671] usb 2-1: Manufacturer: syz [ 981.385970][T11671] usb 2-1: SerialNumber: syz [ 981.424764][ T5] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 981.450704][T11729] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 981.459347][T11671] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 981.500424][ T17] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 981.507350][ T17] ath9k_htc: Failed to initialize the device [ 981.580400][T11790] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 981.587314][T11790] ath9k_htc: Failed to initialize the device [ 981.598846][ T7] usb 4-1: ath9k_htc: USB layer deinitialized 23:07:07 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 981.777420][ T9028] usb 6-1: USB disconnect, device number 62 [ 981.784538][ T9028] usb 6-1: ath9k_htc: USB layer deinitialized [ 981.840964][T23314] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 981.850095][T23314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.864329][T23314] usb 1-1: Product: syz [ 981.868701][T23314] usb 1-1: Manufacturer: syz [ 981.873711][T23314] usb 1-1: SerialNumber: syz [ 981.930577][T23314] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 981.950331][ T7] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 982.080341][ T5] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 982.100351][T11671] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 982.109341][T11729] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 982.283094][T11605] usb 3-1: USB disconnect, device number 92 [ 982.290790][ T9028] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 982.304980][T12487] usb 5-1: USB disconnect, device number 77 [ 982.305632][ T9328] usb 2-1: USB disconnect, device number 65 [ 982.510245][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 982.519493][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.529230][ T7] usb 4-1: Product: syz [ 982.534766][ T7] usb 4-1: Manufacturer: syz [ 982.540638][ T7] usb 4-1: SerialNumber: syz [ 982.550274][T23314] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 982.580462][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:08 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 982.754313][ T3704] usb 1-1: USB disconnect, device number 67 23:07:08 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) 23:07:08 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x0, 0x0, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 982.851785][ T9028] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 982.874767][ T9028] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.892081][ T9028] usb 6-1: Product: syz [ 982.896279][ T9028] usb 6-1: Manufacturer: syz [ 982.907566][ T9028] usb 6-1: SerialNumber: syz [ 982.970449][ T9028] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 983.100217][ T5] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 983.107105][ T5] ath9k_htc: Failed to initialize the device [ 983.114887][T11605] usb 3-1: ath9k_htc: USB layer deinitialized [ 983.180192][T11729] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 983.187218][T11729] ath9k_htc: Failed to initialize the device [ 983.193242][T11671] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 983.200303][T11671] ath9k_htc: Failed to initialize the device [ 983.206296][T12487] usb 5-1: ath9k_htc: USB layer deinitialized [ 983.206393][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 983.220123][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:08 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 983.424304][T11615] usb 4-1: USB disconnect, device number 67 [ 983.490146][T11605] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 983.570072][T12487] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 983.590115][T23314] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 983.597056][T23314] ath9k_htc: Failed to initialize the device [ 983.603088][ T3704] usb 1-1: ath9k_htc: USB layer deinitialized [ 983.620069][ T9328] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 983.640586][ T9028] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:09 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 983.990588][ T3704] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 984.060180][T11605] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 984.069241][T11605] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.083240][T11605] usb 3-1: Product: syz [ 984.087398][T11605] usb 3-1: Manufacturer: syz [ 984.090252][T12487] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 984.101198][T11605] usb 3-1: SerialNumber: syz [ 984.103087][T12487] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.116333][T12487] usb 5-1: Product: syz [ 984.122851][T12487] usb 5-1: Manufacturer: syz [ 984.127533][T12487] usb 5-1: SerialNumber: syz [ 984.140833][T11605] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 984.170257][T12487] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 984.190494][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 984.199537][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.213732][ T9328] usb 2-1: Product: syz [ 984.217880][ T9328] usb 2-1: Manufacturer: syz [ 984.228168][ T9328] usb 2-1: SerialNumber: syz [ 984.270304][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 984.310135][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 984.317125][ T7] ath9k_htc: Failed to initialize the device [ 984.329115][T11615] usb 4-1: ath9k_htc: USB layer deinitialized [ 984.550054][ T3704] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 984.559243][ T3704] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.574072][ T3704] usb 1-1: Product: syz [ 984.578538][ T3704] usb 1-1: Manufacturer: syz [ 984.589290][ T3704] usb 1-1: SerialNumber: syz [ 984.650703][ T3704] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 984.700026][T11615] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 984.707773][ T9028] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 984.714765][ T9028] ath9k_htc: Failed to initialize the device [ 984.739936][T12487] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 984.790206][T11605] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:10 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 984.853508][ T55] usb 6-1: USB disconnect, device number 63 [ 984.881494][ T55] usb 6-1: ath9k_htc: USB layer deinitialized [ 984.940022][ T9328] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 984.951970][ T17] usb 5-1: USB disconnect, device number 78 [ 984.994078][T11790] usb 3-1: USB disconnect, device number 93 [ 985.143246][T23314] usb 2-1: USB disconnect, device number 66 [ 985.290182][ T55] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 985.329875][ T3704] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 985.339023][T11615] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 985.348639][T11615] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.356742][T11615] usb 4-1: Product: syz [ 985.361115][T11615] usb 4-1: Manufacturer: syz [ 985.366229][T11615] usb 4-1: SerialNumber: syz 23:07:10 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 985.420188][T11615] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:10 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 985.533526][ T3670] usb 1-1: USB disconnect, device number 68 23:07:10 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x0, 0x0, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 985.809862][ T55] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 985.819799][T12487] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 985.820107][T11605] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 985.827857][T12487] ath9k_htc: Failed to initialize the device [ 985.845305][ T55] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.848338][T11605] ath9k_htc: Failed to initialize the device [ 985.853582][ T55] usb 6-1: Product: syz [ 985.868114][T11790] usb 3-1: ath9k_htc: USB layer deinitialized [ 985.874386][ T17] usb 5-1: ath9k_htc: USB layer deinitialized [ 985.885531][ T55] usb 6-1: Manufacturer: syz [ 985.890460][ T55] usb 6-1: SerialNumber: syz [ 985.930102][ T55] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 985.979776][ T9328] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 985.986940][ T9328] ath9k_htc: Failed to initialize the device [ 985.993150][T23314] usb 2-1: ath9k_htc: USB layer deinitialized 23:07:11 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 986.079779][T11615] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 986.229746][ T17] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 986.237434][T11790] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 986.283056][ T9028] usb 4-1: USB disconnect, device number 68 [ 986.379760][ T3704] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 986.386779][ T3704] ath9k_htc: Failed to initialize the device [ 986.392863][T23314] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 986.409012][ T3670] usb 1-1: ath9k_htc: USB layer deinitialized [ 986.489784][T11743] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 986.749757][ T17] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 986.758895][ T17] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.766945][T11790] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 986.776657][ T3670] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 986.786066][T11790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.794279][ T17] usb 5-1: Product: syz 23:07:12 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 986.798553][ T17] usb 5-1: Manufacturer: syz [ 986.804498][T11790] usb 3-1: Product: syz [ 986.808650][T11790] usb 3-1: Manufacturer: syz [ 986.813621][ T17] usb 5-1: SerialNumber: syz [ 986.818231][T11790] usb 3-1: SerialNumber: syz [ 986.861289][ T17] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 986.872255][T11790] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 986.979645][T23314] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 986.988975][T23314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.998955][T23314] usb 2-1: Product: syz [ 987.005672][T23314] usb 2-1: Manufacturer: syz [ 987.013014][T23314] usb 2-1: SerialNumber: syz [ 987.050990][T23314] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 987.099708][T11615] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 987.107590][T11615] ath9k_htc: Failed to initialize the device [ 987.115033][ T9028] usb 4-1: ath9k_htc: USB layer deinitialized [ 987.299663][ T3670] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 987.308848][ T3670] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.322962][ T3670] usb 1-1: Product: syz [ 987.327143][ T3670] usb 1-1: Manufacturer: syz [ 987.337421][ T3670] usb 1-1: SerialNumber: syz [ 987.379891][ T3670] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 987.439626][T12487] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 987.448617][ T17] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 987.489612][ T9028] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 987.499608][T11743] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 987.506463][T11743] ath9k_htc: Failed to initialize the device [ 987.641894][T11790] usb 3-1: USB disconnect, device number 94 [ 987.645062][T11605] usb 5-1: USB disconnect, device number 79 [ 987.699583][T23314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:13 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 987.882529][ T9760] usb 6-1: USB disconnect, device number 64 [ 987.893189][ T9760] usb 6-1: ath9k_htc: USB layer deinitialized [ 987.903572][ T9328] usb 2-1: USB disconnect, device number 67 [ 987.949531][ T3670] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 988.029515][ T9028] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 988.038600][ T9028] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.047969][ T9028] usb 4-1: Product: syz [ 988.053815][ T9028] usb 4-1: Manufacturer: syz [ 988.058834][ T9028] usb 4-1: SerialNumber: syz [ 988.099782][ T9028] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:13 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:13 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 988.170746][ T3704] usb 1-1: USB disconnect, device number 69 23:07:13 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x0, 0x0, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 988.369455][ T9760] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 988.459463][ T17] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 988.466515][T12487] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 988.473498][T12487] ath9k_htc: Failed to initialize the device [ 988.488168][ T17] ath9k_htc: Failed to initialize the device [ 988.496765][T11790] usb 3-1: ath9k_htc: USB layer deinitialized [ 988.508679][T11605] usb 5-1: ath9k_htc: USB layer deinitialized 23:07:13 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 988.779401][T23314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 988.786395][ T9028] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 988.795407][T23314] ath9k_htc: Failed to initialize the device [ 988.802174][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 988.859414][T11790] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 988.879471][T11605] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 988.889463][ T9760] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 988.898635][ T9760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.909925][ T9760] usb 6-1: Product: syz [ 988.914114][ T9760] usb 6-1: Manufacturer: syz [ 988.918732][ T9760] usb 6-1: SerialNumber: syz [ 988.959715][ T9760] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 988.984842][ T7] usb 4-1: USB disconnect, device number 69 [ 989.019378][ T3670] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 989.026488][ T3670] ath9k_htc: Failed to initialize the device [ 989.034914][ T3704] usb 1-1: ath9k_htc: USB layer deinitialized [ 989.159752][ T9328] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 989.390475][T11790] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 989.399934][T11790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.407920][T11790] usb 3-1: Product: syz [ 989.409312][ T3704] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 989.412325][T11790] usb 3-1: Manufacturer: syz [ 989.425277][T11790] usb 3-1: SerialNumber: syz 23:07:14 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 989.469590][T11790] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 989.489688][T11605] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 989.502034][T11605] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.513400][T11605] usb 5-1: Product: syz [ 989.519570][T11605] usb 5-1: Manufacturer: syz [ 989.524200][T11605] usb 5-1: SerialNumber: syz [ 989.531971][ T9760] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 989.570174][T11605] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 989.729300][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 989.738454][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.750756][ T9328] usb 2-1: Product: syz [ 989.756214][ T9328] usb 2-1: Manufacturer: syz [ 989.761815][ T9328] usb 2-1: SerialNumber: syz [ 989.809648][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 989.820720][ T9028] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 989.828786][ T9028] ath9k_htc: Failed to initialize the device [ 989.835814][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 989.999469][ T3704] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 990.008542][ T3704] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 990.016805][ T3704] usb 1-1: Product: syz [ 990.022214][ T3704] usb 1-1: Manufacturer: syz [ 990.027790][ T3704] usb 1-1: SerialNumber: syz [ 990.039769][T11790] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 990.070949][ T3704] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 990.209325][ T7] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 990.229557][T11605] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 990.243802][ T3670] usb 3-1: USB disconnect, device number 95 [ 990.431409][T11615] usb 5-1: USB disconnect, device number 80 [ 990.469690][ T9328] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 990.619263][ T9760] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 990.626649][ T9760] ath9k_htc: Failed to initialize the device [ 990.673703][T23314] usb 2-1: USB disconnect, device number 68 23:07:16 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 990.719198][ T3704] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 990.769202][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 990.778424][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 990.799431][ T7] usb 4-1: Product: syz [ 990.803641][ T7] usb 4-1: Manufacturer: syz [ 990.808680][ T7] usb 4-1: SerialNumber: syz [ 990.850387][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:16 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) 23:07:16 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x0, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 990.923727][ T17] usb 1-1: USB disconnect, device number 70 [ 990.933168][ T9028] usb 6-1: USB disconnect, device number 65 [ 990.954025][ T9028] usb 6-1: ath9k_htc: USB layer deinitialized [ 991.099124][T11790] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 991.106192][T11790] ath9k_htc: Failed to initialize the device [ 991.112549][ T3670] usb 3-1: ath9k_htc: USB layer deinitialized 23:07:16 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x0, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 991.259113][T11605] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 991.266077][T11605] ath9k_htc: Failed to initialize the device [ 991.272173][T11615] usb 5-1: ath9k_htc: USB layer deinitialized 23:07:16 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 991.450539][ T9028] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 991.469052][ T3670] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 991.499278][ T9328] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 991.507303][ T9328] ath9k_htc: Failed to initialize the device [ 991.519224][T23314] usb 2-1: ath9k_htc: USB layer deinitialized [ 991.539075][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 991.639096][T11615] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 991.739038][ T3704] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 991.748013][ T3704] ath9k_htc: Failed to initialize the device [ 991.761204][ T17] usb 1-1: ath9k_htc: USB layer deinitialized [ 991.761451][T11671] usb 4-1: USB disconnect, device number 70 [ 991.909357][T23314] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 991.989088][ T3670] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 991.998152][ T3670] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.006517][ T3670] usb 3-1: Product: syz [ 992.011785][ T3670] usb 3-1: Manufacturer: syz [ 992.016877][ T3670] usb 3-1: SerialNumber: syz [ 992.029547][ T9028] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 992.043568][ T9028] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.052189][ T9028] usb 6-1: Product: syz [ 992.056380][ T9028] usb 6-1: Manufacturer: syz [ 992.059578][ T3670] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 992.062669][ T9028] usb 6-1: SerialNumber: syz [ 992.119173][ T17] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 992.119313][ T9028] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 992.219006][T11615] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 992.228108][T11615] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.244570][T11615] usb 5-1: Product: syz [ 992.248881][T11615] usb 5-1: Manufacturer: syz 23:07:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 992.264955][T11615] usb 5-1: SerialNumber: syz [ 992.309927][T11615] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 992.509010][T23314] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 992.518265][T23314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.527695][T23314] usb 2-1: Product: syz [ 992.534322][T23314] usb 2-1: Manufacturer: syz [ 992.539630][T23314] usb 2-1: SerialNumber: syz [ 992.579224][T23314] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 992.618945][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 992.625891][ T7] ath9k_htc: Failed to initialize the device [ 992.637489][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 992.638950][ T17] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 992.653093][ T3670] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 992.665191][ T17] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.673914][ T17] usb 1-1: Product: syz [ 992.678188][ T17] usb 1-1: Manufacturer: syz [ 992.685922][ T17] usb 1-1: SerialNumber: syz [ 992.729261][ T17] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 992.788972][ T9028] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 992.864410][ T3704] usb 3-1: USB disconnect, device number 96 [ 992.968961][ T5] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 993.018980][T11671] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 993.170682][T11790] usb 5-1: USB disconnect, device number 81 [ 993.218896][T23314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 993.298861][ T17] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:18 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 993.422995][ T9328] usb 2-1: USB disconnect, device number 69 [ 993.502080][T11605] usb 1-1: USB disconnect, device number 71 [ 993.578927][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 993.588103][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.602279][T11671] usb 4-1: Product: syz [ 993.606438][T11671] usb 4-1: Manufacturer: syz [ 993.617010][T11671] usb 4-1: SerialNumber: syz 23:07:18 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 993.659188][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 993.740472][ T3670] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 993.747351][ T3670] ath9k_htc: Failed to initialize the device [ 993.759547][ T3704] usb 3-1: ath9k_htc: USB layer deinitialized [ 993.818897][ T9028] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 993.825938][ T9028] ath9k_htc: Failed to initialize the device 23:07:19 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x0, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:07:19 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x0, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 993.978902][ T5] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 993.985883][ T5] ath9k_htc: Failed to initialize the device [ 993.996813][T11790] usb 5-1: ath9k_htc: USB layer deinitialized [ 994.018361][ T9760] usb 6-1: USB disconnect, device number 66 23:07:19 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 994.040266][ T9760] usb 6-1: ath9k_htc: USB layer deinitialized [ 994.138749][ T3704] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 994.298774][T23314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 994.306772][T23314] ath9k_htc: Failed to initialize the device [ 994.318232][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 994.328719][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 994.349656][T11790] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 994.378766][ T17] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 994.385772][ T17] ath9k_htc: Failed to initialize the device [ 994.392273][T11605] usb 1-1: ath9k_htc: USB layer deinitialized [ 994.498724][ T9760] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 994.527234][T11671] usb 4-1: USB disconnect, device number 71 [ 994.698912][ T9328] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 994.718815][ T3704] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 994.727902][ T3704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.737314][ T3704] usb 3-1: Product: syz [ 994.743829][ T3704] usb 3-1: Manufacturer: syz [ 994.748970][ T3704] usb 3-1: SerialNumber: syz [ 994.758634][T11605] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 994.798935][ T3704] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 994.868702][T11790] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 994.877956][T11790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.886353][T11790] usb 5-1: Product: syz [ 994.892307][T11790] usb 5-1: Manufacturer: syz [ 994.899322][T11790] usb 5-1: SerialNumber: syz [ 994.938928][T11790] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:20 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 995.018714][ T9760] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 995.028006][ T9760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.036031][ T9760] usb 6-1: Product: syz [ 995.040694][ T9760] usb 6-1: Manufacturer: syz [ 995.045321][ T9760] usb 6-1: SerialNumber: syz [ 995.088878][ T9760] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 995.278668][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 995.289720][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.297817][ T9328] usb 2-1: Product: syz [ 995.309994][ T9328] usb 2-1: Manufacturer: syz [ 995.314860][ T9328] usb 2-1: SerialNumber: syz [ 995.348680][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 995.355613][T11605] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 995.364707][ T7] ath9k_htc: Failed to initialize the device [ 995.371109][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 995.379300][T11605] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.387441][T11605] usb 1-1: Product: syz [ 995.393837][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 995.400885][T11605] usb 1-1: Manufacturer: syz [ 995.405799][T11605] usb 1-1: SerialNumber: syz [ 995.440824][T11729] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 995.469319][T11605] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 995.498602][T11790] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 995.642421][T12487] usb 3-1: USB disconnect, device number 97 [ 995.658706][ T9760] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 995.701195][ T17] usb 5-1: USB disconnect, device number 82 [ 995.748540][T11671] usb 4-1: new high-speed USB device number 72 using dummy_hcd 23:07:21 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 996.118525][ T9328] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:21 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 996.190559][T11605] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 996.321406][T23314] usb 2-1: USB disconnect, device number 70 [ 996.338847][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 996.348125][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.357896][T11671] usb 4-1: Product: syz [ 996.364270][T11671] usb 4-1: Manufacturer: syz [ 996.369324][T11671] usb 4-1: SerialNumber: syz [ 996.393432][ T3670] usb 1-1: USB disconnect, device number 72 [ 996.410081][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 996.468454][T11729] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 996.475407][T11729] ath9k_htc: Failed to initialize the device [ 996.485860][T12487] usb 3-1: ath9k_htc: USB layer deinitialized [ 996.538979][T11790] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 996.545892][T11790] ath9k_htc: Failed to initialize the device [ 996.556732][ T17] usb 5-1: ath9k_htc: USB layer deinitialized [ 996.698481][ T9760] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 996.705776][ T9760] ath9k_htc: Failed to initialize the device 23:07:22 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x0, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:07:22 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 996.848368][T12487] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 996.918469][ T17] usb 5-1: new high-speed USB device number 83 using dummy_hcd 23:07:22 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x0, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 997.058400][T11671] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 997.076546][ T7] usb 6-1: USB disconnect, device number 67 [ 997.084404][ T7] usb 6-1: ath9k_htc: USB layer deinitialized [ 997.178398][ T9328] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 997.185329][ T9328] ath9k_htc: Failed to initialize the device [ 997.194454][T23314] usb 2-1: ath9k_htc: USB layer deinitialized [ 997.258365][T11605] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 997.265293][T11605] ath9k_htc: Failed to initialize the device [ 997.273501][ T3670] usb 1-1: ath9k_htc: USB layer deinitialized [ 997.285207][T15666] usb 4-1: USB disconnect, device number 72 [ 997.368334][T12487] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 997.377528][T12487] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.392692][T12487] usb 3-1: Product: syz [ 997.396899][T12487] usb 3-1: Manufacturer: syz [ 997.408206][T12487] usb 3-1: SerialNumber: syz [ 997.438499][ T17] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 997.447691][ T17] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.459937][T12487] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 997.469250][ T17] usb 5-1: Product: syz [ 997.473391][ T17] usb 5-1: Manufacturer: syz [ 997.478235][ T17] usb 5-1: SerialNumber: syz [ 997.518772][ T17] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 997.548294][ T7] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 997.578289][T23314] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 997.638284][ T3670] usb 1-1: new high-speed USB device number 73 using dummy_hcd 23:07:23 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 998.038283][T12487] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 998.088634][ T17] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 998.128247][ T7] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 998.137365][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.145489][T11671] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 998.152996][T23314] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 998.159575][ T3670] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 998.163421][ T7] usb 6-1: Product: syz [ 998.176993][T11671] ath9k_htc: Failed to initialize the device [ 998.181953][ T3670] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.183079][T23314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.199647][ T3670] usb 1-1: Product: syz [ 998.201100][ T7] usb 6-1: Manufacturer: syz [ 998.203825][T15666] usb 4-1: ath9k_htc: USB layer deinitialized [ 998.208526][ T7] usb 6-1: SerialNumber: syz [ 998.220558][T23314] usb 2-1: Product: syz [ 998.223988][ T3670] usb 1-1: Manufacturer: syz [ 998.227946][T23314] usb 2-1: Manufacturer: syz [ 998.234757][ T3670] usb 1-1: SerialNumber: syz [ 998.234847][T23314] usb 2-1: SerialNumber: syz [ 998.264232][T11790] usb 3-1: USB disconnect, device number 98 [ 998.278448][ T7] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 998.288586][T23314] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 998.308909][ T9328] usb 5-1: USB disconnect, device number 83 [ 998.309046][ T3670] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 998.568176][T15666] usb 4-1: new high-speed USB device number 73 using dummy_hcd 23:07:24 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:24 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 998.898145][ T3670] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 998.958136][T11729] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 998.988377][T23314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 999.088147][T15666] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 999.097412][T15666] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.105627][T12487] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 999.108002][T11605] usb 1-1: USB disconnect, device number 73 [ 999.113870][T15666] usb 4-1: Product: syz [ 999.123746][T12487] ath9k_htc: Failed to initialize the device [ 999.135174][T15666] usb 4-1: Manufacturer: syz [ 999.140984][T11790] usb 3-1: ath9k_htc: USB layer deinitialized [ 999.157578][T15666] usb 4-1: SerialNumber: syz [ 999.178229][ T17] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 999.185229][ T17] ath9k_htc: Failed to initialize the device [ 999.198203][ T9328] usb 5-1: ath9k_htc: USB layer deinitialized [ 999.208534][T15666] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 999.232790][ T9760] usb 2-1: USB disconnect, device number 71 [ 999.499103][T11790] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 999.568090][ T9328] usb 5-1: new high-speed USB device number 84 using dummy_hcd 23:07:24 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:25 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0x0, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 999.788028][T15666] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 999.978022][ T3670] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 999.978146][T11729] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 999.985205][ T3670] ath9k_htc: Failed to initialize the device [ 999.998692][T11729] ath9k_htc: Failed to initialize the device [ 1000.005990][ T5] usb 4-1: USB disconnect, device number 73 [ 1000.014665][T11605] usb 1-1: ath9k_htc: USB layer deinitialized [ 1000.018208][T11790] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1000.040374][T11790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.050381][T11790] usb 3-1: Product: syz [ 1000.055487][T11790] usb 3-1: Manufacturer: syz [ 1000.061016][T11790] usb 3-1: SerialNumber: syz [ 1000.070397][T23314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1000.077511][T23314] ath9k_htc: Failed to initialize the device [ 1000.091734][ T9760] usb 2-1: ath9k_htc: USB layer deinitialized [ 1000.108384][T11790] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1000.128298][ T9328] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1000.137604][ T9328] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.146342][ T9328] usb 5-1: Product: syz [ 1000.155126][ T9328] usb 5-1: Manufacturer: syz [ 1000.159756][ T9328] usb 5-1: SerialNumber: syz 23:07:25 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x0, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1000.178192][T12487] usb 6-1: USB disconnect, device number 68 [ 1000.199738][T12487] usb 6-1: ath9k_htc: USB layer deinitialized [ 1000.229751][ T9328] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1000.397960][T11605] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1000.448242][ T9760] usb 2-1: new high-speed USB device number 72 using dummy_hcd 23:07:25 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1000.647904][T12487] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1000.668136][T11790] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1000.857920][T15666] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1000.864853][T15666] ath9k_htc: Failed to initialize the device [ 1000.873811][T11671] usb 3-1: USB disconnect, device number 99 [ 1000.881394][ T5] usb 4-1: ath9k_htc: USB layer deinitialized [ 1000.917903][ T9328] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1000.967912][ T9760] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1000.967943][T11605] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1000.977754][ T9760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.987758][T11605] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.005303][T11605] usb 1-1: Product: syz [ 1001.009793][ T9760] usb 2-1: Product: syz [ 1001.011033][T11605] usb 1-1: Manufacturer: syz [ 1001.019987][ T9760] usb 2-1: Manufacturer: syz [ 1001.023655][T11605] usb 1-1: SerialNumber: syz [ 1001.029590][ T9760] usb 2-1: SerialNumber: syz [ 1001.068241][T11605] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1001.068465][ T9760] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1001.119605][T23314] usb 5-1: USB disconnect, device number 84 [ 1001.167873][T12487] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1001.176939][T12487] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.185600][T12487] usb 6-1: Product: syz [ 1001.191875][T12487] usb 6-1: Manufacturer: syz [ 1001.196483][T12487] usb 6-1: SerialNumber: syz [ 1001.238096][T12487] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1001.260864][ T5] usb 4-1: new high-speed USB device number 74 using dummy_hcd 23:07:26 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:26 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1001.667973][ T9760] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1001.717787][T11605] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1001.739327][T11790] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1001.746202][T11790] ath9k_htc: Failed to initialize the device [ 1001.752548][T11671] usb 3-1: ath9k_htc: USB layer deinitialized [ 1001.807806][T12487] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1001.819363][ T5] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1001.829590][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.838005][ T5] usb 4-1: Product: syz [ 1001.844687][ T5] usb 4-1: Manufacturer: syz [ 1001.849449][ T5] usb 4-1: SerialNumber: syz [ 1001.872100][ T55] usb 2-1: USB disconnect, device number 72 [ 1001.889549][ T5] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1001.920895][ T9028] usb 1-1: USB disconnect, device number 74 [ 1001.987739][ T9328] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1001.994680][ T9328] ath9k_htc: Failed to initialize the device [ 1002.006281][T23314] usb 5-1: ath9k_htc: USB layer deinitialized [ 1002.107762][T11671] usb 3-1: new high-speed USB device number 100 using dummy_hcd 23:07:27 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0x0, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1002.367817][T23314] usb 5-1: new high-speed USB device number 85 using dummy_hcd 23:07:27 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1002.527731][ T5] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1002.657822][T11671] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1002.666920][T11671] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.676231][T11671] usb 3-1: Product: syz [ 1002.681845][T11671] usb 3-1: Manufacturer: syz [ 1002.686738][T11671] usb 3-1: SerialNumber: syz [ 1002.697710][ T9760] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1002.708738][ T9760] ath9k_htc: Failed to initialize the device [ 1002.720644][ T55] usb 2-1: ath9k_htc: USB layer deinitialized [ 1002.733217][T11671] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1002.746863][T11671] usb 4-1: USB disconnect, device number 74 [ 1002.777877][T11605] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1002.784753][T11605] ath9k_htc: Failed to initialize the device [ 1002.790913][ T9028] usb 1-1: ath9k_htc: USB layer deinitialized [ 1002.857653][T12487] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1002.864700][T12487] ath9k_htc: Failed to initialize the device [ 1002.977641][T23314] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1002.988140][T23314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.996124][T23314] usb 5-1: Product: syz [ 1003.001570][T23314] usb 5-1: Manufacturer: syz [ 1003.006705][T23314] usb 5-1: SerialNumber: syz [ 1003.049332][T23314] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1003.077597][ T55] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1003.167602][ T9028] usb 1-1: new high-speed USB device number 75 using dummy_hcd 23:07:28 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x0, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') 23:07:28 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1003.223881][ T9328] usb 6-1: USB disconnect, device number 69 [ 1003.232247][ T9328] usb 6-1: ath9k_htc: USB layer deinitialized [ 1003.427582][T11729] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1003.577660][ T5] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1003.584696][ T5] ath9k_htc: Failed to initialize the device [ 1003.590874][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 1003.598410][ T55] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1003.608293][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.622139][ T55] usb 2-1: Product: syz [ 1003.626357][ T55] usb 2-1: Manufacturer: syz [ 1003.633792][ T55] usb 2-1: SerialNumber: syz [ 1003.642649][T15666] usb 3-1: USB disconnect, device number 100 [ 1003.677874][ T55] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1003.737563][T23314] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1003.746998][ T9328] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1003.787770][ T9028] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1003.796881][ T9028] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.809767][ T9028] usb 1-1: Product: syz [ 1003.814812][ T9028] usb 1-1: Manufacturer: syz [ 1003.819860][ T9028] usb 1-1: SerialNumber: syz [ 1003.867826][ T9028] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1003.939774][T11790] usb 5-1: USB disconnect, device number 85 [ 1003.967501][T11671] usb 4-1: new high-speed USB device number 75 using dummy_hcd 23:07:29 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1004.237485][ T55] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1004.347479][ T9328] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1004.356773][ T9328] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.366153][ T9328] usb 6-1: Product: syz [ 1004.372829][ T9328] usb 6-1: Manufacturer: syz [ 1004.378369][ T9328] usb 6-1: SerialNumber: syz 23:07:29 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1004.427787][ T9328] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1004.444092][T12487] usb 2-1: USB disconnect, device number 73 [ 1004.457719][T11729] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1004.472569][T11729] ath9k_htc: Failed to initialize the device [ 1004.493141][T15666] usb 3-1: ath9k_htc: USB layer deinitialized [ 1004.507954][ T9028] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1004.557509][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1004.566757][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.576218][T11671] usb 4-1: Product: syz [ 1004.582924][T11671] usb 4-1: Manufacturer: syz [ 1004.588256][T11671] usb 4-1: SerialNumber: syz [ 1004.630887][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1004.709994][ T9760] usb 1-1: USB disconnect, device number 75 [ 1004.787458][T23314] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1004.795717][T23314] ath9k_htc: Failed to initialize the device [ 1004.804500][T11790] usb 5-1: ath9k_htc: USB layer deinitialized [ 1004.847392][T15666] usb 3-1: new high-speed USB device number 101 using dummy_hcd 23:07:30 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0x0, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1005.067405][ T9328] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1005.157338][T11790] usb 5-1: new high-speed USB device number 86 using dummy_hcd 23:07:30 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1005.257361][ T55] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1005.257419][T11671] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1005.264246][ T55] ath9k_htc: Failed to initialize the device [ 1005.264280][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1005.387348][T15666] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1005.396474][T15666] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.406507][T15666] usb 3-1: Product: syz [ 1005.412682][T15666] usb 3-1: Manufacturer: syz [ 1005.418951][T15666] usb 3-1: SerialNumber: syz [ 1005.458838][T15666] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1005.461832][ T5] usb 4-1: USB disconnect, device number 75 [ 1005.577341][ T9028] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1005.584365][ T9028] ath9k_htc: Failed to initialize the device [ 1005.596585][ T9760] usb 1-1: ath9k_htc: USB layer deinitialized [ 1005.657275][T12487] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1005.687317][T11790] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1005.696532][T11790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.706374][T11790] usb 5-1: Product: syz [ 1005.712741][T11790] usb 5-1: Manufacturer: syz [ 1005.718031][T11790] usb 5-1: SerialNumber: syz [ 1005.757572][T11790] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:31 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1005.957262][ T9760] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 1006.027299][T15666] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1006.137263][ T9328] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1006.144222][ T9328] ath9k_htc: Failed to initialize the device [ 1006.177258][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1006.186365][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.195785][T12487] usb 2-1: Product: syz [ 1006.204077][T12487] usb 2-1: Manufacturer: syz [ 1006.208808][T12487] usb 2-1: SerialNumber: syz [ 1006.229254][ T3670] usb 3-1: USB disconnect, device number 101 [ 1006.247737][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:31 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x0, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1006.304595][ T55] usb 6-1: USB disconnect, device number 70 [ 1006.307507][T11671] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1006.317253][T11790] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1006.327721][ T55] usb 6-1: ath9k_htc: USB layer deinitialized [ 1006.338279][T11671] ath9k_htc: Failed to initialize the device [ 1006.352555][ T5] usb 4-1: ath9k_htc: USB layer deinitialized [ 1006.487201][ T9760] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1006.496356][ T9760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.507463][ T9760] usb 1-1: Product: syz [ 1006.511646][ T9760] usb 1-1: Manufacturer: syz [ 1006.519787][ T9760] usb 1-1: SerialNumber: syz [ 1006.530272][T11743] usb 5-1: USB disconnect, device number 86 [ 1006.557439][ T9760] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:32 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1006.717140][ T5] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1006.787547][ T55] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1006.827192][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:32 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1007.031447][T23314] usb 2-1: USB disconnect, device number 74 [ 1007.100798][T15666] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1007.112675][T15666] ath9k_htc: Failed to initialize the device [ 1007.120821][ T3670] usb 3-1: ath9k_htc: USB layer deinitialized [ 1007.128250][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1007.307477][ T5] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1007.316544][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1007.317377][ T55] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1007.334366][ T5] usb 4-1: Product: syz [ 1007.336286][ T55] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1007.340686][ T55] usb 6-1: Product: syz [ 1007.356441][ T55] usb 6-1: Manufacturer: syz [ 1007.356839][ T5] usb 4-1: Manufacturer: syz [ 1007.362160][ T55] usb 6-1: SerialNumber: syz [ 1007.371420][ T5] usb 4-1: SerialNumber: syz [ 1007.388078][T11729] usb 1-1: USB disconnect, device number 76 [ 1007.409066][ T55] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1007.417594][T11790] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1007.424444][T11790] ath9k_htc: Failed to initialize the device [ 1007.438088][ T5] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1007.439486][T11743] usb 5-1: ath9k_htc: USB layer deinitialized [ 1007.497111][ T3670] usb 3-1: new high-speed USB device number 102 using dummy_hcd 23:07:32 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x0, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1007.807069][T11743] usb 5-1: new high-speed USB device number 87 using dummy_hcd 23:07:33 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1007.897275][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1007.904350][T12487] ath9k_htc: Failed to initialize the device [ 1007.917728][T23314] usb 2-1: ath9k_htc: USB layer deinitialized [ 1008.007039][ T55] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1008.027098][ T3670] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1008.036156][ T3670] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1008.050431][ T3670] usb 3-1: Product: syz [ 1008.054590][ T3670] usb 3-1: Manufacturer: syz [ 1008.065296][ T3670] usb 3-1: SerialNumber: syz [ 1008.096991][ T5] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1008.113194][ T3670] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1008.217055][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1008.227291][ T9760] ath9k_htc: Failed to initialize the device [ 1008.233353][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 1008.277047][T23314] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1008.303600][ T9328] usb 4-1: USB disconnect, device number 76 [ 1008.327019][T11743] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1008.336314][T11743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1008.346074][T11743] usb 5-1: Product: syz [ 1008.352534][T11743] usb 5-1: Manufacturer: syz [ 1008.359994][T11743] usb 5-1: SerialNumber: syz [ 1008.397608][T11743] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1008.616969][T11729] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 1008.676918][ T3670] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:34 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1008.848843][T23314] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1008.858872][T23314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1008.875900][T23314] usb 2-1: Product: syz [ 1008.879501][ T17] usb 3-1: USB disconnect, device number 102 [ 1008.886043][T23314] usb 2-1: Manufacturer: syz [ 1008.897126][T23314] usb 2-1: SerialNumber: syz [ 1008.947204][T23314] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1008.968843][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1009.016945][ T55] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1009.023860][ T55] ath9k_htc: Failed to initialize the device [ 1009.169764][T11790] usb 5-1: USB disconnect, device number 87 [ 1009.176874][ T5] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1009.186731][ T5] ath9k_htc: Failed to initialize the device [ 1009.196661][ T9328] usb 4-1: ath9k_htc: USB layer deinitialized [ 1009.204234][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1009.214342][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.225255][T11729] usb 1-1: Product: syz [ 1009.229608][T11729] usb 1-1: Manufacturer: syz [ 1009.235132][T11729] usb 1-1: SerialNumber: syz [ 1009.277351][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:34 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x0, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') 23:07:34 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1009.372641][ T9028] usb 6-1: USB disconnect, device number 71 [ 1009.394361][ T9028] usb 6-1: ath9k_htc: USB layer deinitialized [ 1009.556842][T23314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1009.586804][ T9328] usb 4-1: new high-speed USB device number 77 using dummy_hcd 23:07:34 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1009.736798][ T3670] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1009.743679][ T3670] ath9k_htc: Failed to initialize the device [ 1009.751362][ T17] usb 3-1: ath9k_htc: USB layer deinitialized [ 1009.768833][T11605] usb 2-1: USB disconnect, device number 75 [ 1009.867072][ T9028] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1009.906909][T11671] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1010.056763][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1010.063706][T11743] ath9k_htc: Failed to initialize the device [ 1010.069742][T11790] usb 5-1: ath9k_htc: USB layer deinitialized [ 1010.106736][ T17] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1010.111452][T11729] usb 1-1: USB disconnect, device number 77 [ 1010.137174][ T9328] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1010.146230][ T9328] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.155767][ T9328] usb 4-1: Product: syz [ 1010.162321][ T9328] usb 4-1: Manufacturer: syz [ 1010.169451][ T9328] usb 4-1: SerialNumber: syz [ 1010.217108][ T9328] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:35 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x0, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1010.426725][T11790] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1010.456736][ T9028] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1010.465980][ T9028] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.479251][ T9028] usb 6-1: Product: syz [ 1010.483458][ T9028] usb 6-1: Manufacturer: syz [ 1010.493839][ T9028] usb 6-1: SerialNumber: syz [ 1010.546996][ T9028] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:35 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1010.626707][ T17] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1010.636284][T23314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1010.645127][ T17] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.651231][T23314] ath9k_htc: Failed to initialize the device [ 1010.653433][ T17] usb 3-1: Product: syz [ 1010.663794][ T17] usb 3-1: Manufacturer: syz [ 1010.671396][ T17] usb 3-1: SerialNumber: syz [ 1010.679574][T11605] usb 2-1: ath9k_htc: USB layer deinitialized [ 1010.716971][ T17] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1010.876682][ T9328] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1010.946682][T11671] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1010.946874][T11790] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1010.953972][T11671] ath9k_htc: Failed to initialize the device [ 1010.963083][T11790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.977270][T11790] usb 5-1: Product: syz [ 1010.983358][T11790] usb 5-1: Manufacturer: syz [ 1010.983402][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 1010.988307][T11790] usb 5-1: SerialNumber: syz [ 1011.037137][T11790] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1011.056704][T11605] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1011.079734][ T5] usb 4-1: USB disconnect, device number 77 [ 1011.226618][ T9028] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1011.296615][ T17] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1011.366585][T11729] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 1011.499311][ T9760] usb 3-1: USB disconnect, device number 103 23:07:36 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1011.606633][T11790] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1011.606911][T11605] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1011.634292][T11605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1011.645762][T11605] usb 2-1: Product: syz [ 1011.652509][T11605] usb 2-1: Manufacturer: syz [ 1011.658820][T11605] usb 2-1: SerialNumber: syz [ 1011.707179][T11605] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1011.809649][T23314] usb 5-1: USB disconnect, device number 88 [ 1011.896536][ T9328] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1011.903541][ T9328] ath9k_htc: Failed to initialize the device [ 1011.915093][ T5] usb 4-1: ath9k_htc: USB layer deinitialized [ 1011.927737][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1011.940040][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1011.950834][T11729] usb 1-1: Product: syz [ 1011.955049][T11729] usb 1-1: Manufacturer: syz [ 1011.965557][T11729] usb 1-1: SerialNumber: syz 23:07:37 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1012.006958][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:37 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1012.276473][ T5] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1012.296539][ T9028] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1012.303428][ T9028] ath9k_htc: Failed to initialize the device [ 1012.346583][T11605] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1012.376468][ T17] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1012.383460][ T17] ath9k_htc: Failed to initialize the device [ 1012.392057][ T9760] usb 3-1: ath9k_htc: USB layer deinitialized 23:07:37 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x0, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1012.438839][ T7] usb 6-1: USB disconnect, device number 72 [ 1012.454060][ T7] usb 6-1: ath9k_htc: USB layer deinitialized [ 1012.559485][T11743] usb 2-1: USB disconnect, device number 76 [ 1012.616435][T11790] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1012.623386][T11790] ath9k_htc: Failed to initialize the device [ 1012.630905][T23314] usb 5-1: ath9k_htc: USB layer deinitialized [ 1012.657734][T11729] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1012.746415][ T9760] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1012.856607][ T5] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1012.865685][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.870750][ T55] usb 1-1: USB disconnect, device number 78 [ 1012.874013][ T5] usb 4-1: Product: syz [ 1012.887097][ T5] usb 4-1: Manufacturer: syz [ 1012.892359][ T5] usb 4-1: SerialNumber: syz [ 1012.927957][ T7] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1012.948503][ T5] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1013.006450][T23314] usb 5-1: new high-speed USB device number 89 using dummy_hcd 23:07:38 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x0, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1013.276368][ T9760] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1013.285507][ T9760] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.299900][ T9760] usb 3-1: Product: syz [ 1013.304064][ T9760] usb 3-1: Manufacturer: syz [ 1013.314070][ T9760] usb 3-1: SerialNumber: syz 23:07:38 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1013.356584][ T9760] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1013.426401][T11605] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1013.435852][T11605] ath9k_htc: Failed to initialize the device [ 1013.446130][T11743] usb 2-1: ath9k_htc: USB layer deinitialized [ 1013.506362][ T7] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1013.515558][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.524125][ T7] usb 6-1: Product: syz [ 1013.528558][ T7] usb 6-1: Manufacturer: syz [ 1013.534262][ T7] usb 6-1: SerialNumber: syz [ 1013.576393][T23314] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1013.585820][ T7] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1013.593978][T23314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.603534][ T5] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1013.617218][T23314] usb 5-1: Product: syz [ 1013.622499][T23314] usb 5-1: Manufacturer: syz [ 1013.628200][T23314] usb 5-1: SerialNumber: syz [ 1013.686706][T23314] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1013.736329][T11729] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1013.743230][T11729] ath9k_htc: Failed to initialize the device [ 1013.755401][ T55] usb 1-1: ath9k_htc: USB layer deinitialized [ 1013.806108][ T3670] usb 4-1: USB disconnect, device number 78 [ 1013.816414][T11743] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1013.916283][ T9760] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1014.106260][ T55] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 1014.118867][T11671] usb 3-1: USB disconnect, device number 104 23:07:39 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1014.276469][ T7] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1014.336244][T11743] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1014.345296][T11743] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.357766][T23314] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1014.365731][T11743] usb 2-1: Product: syz [ 1014.373733][T11743] usb 2-1: Manufacturer: syz [ 1014.382367][T11743] usb 2-1: SerialNumber: syz [ 1014.426922][T11743] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1014.558457][T11790] usb 5-1: USB disconnect, device number 89 23:07:39 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1014.626231][ T55] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1014.637821][ T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.645817][ T55] usb 1-1: Product: syz [ 1014.656691][ T55] usb 1-1: Manufacturer: syz [ 1014.670495][ T55] usb 1-1: SerialNumber: syz [ 1014.706225][ T5] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1014.715585][ T5] ath9k_htc: Failed to initialize the device [ 1014.717911][ T55] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1014.736555][ T3670] usb 4-1: ath9k_htc: USB layer deinitialized [ 1014.936174][ T9760] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1014.945017][ T9760] ath9k_htc: Failed to initialize the device [ 1014.954074][T11671] usb 3-1: ath9k_htc: USB layer deinitialized [ 1014.996167][T11743] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:40 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1015.097973][ T3670] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1015.198352][T12487] usb 2-1: USB disconnect, device number 77 [ 1015.306153][ T55] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1015.317551][T11671] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1015.336231][ T7] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1015.343264][ T7] ath9k_htc: Failed to initialize the device [ 1015.426183][T23314] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1015.433132][T23314] ath9k_htc: Failed to initialize the device [ 1015.444564][T11790] usb 5-1: ath9k_htc: USB layer deinitialized 23:07:40 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x0, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1015.489508][T11729] usb 6-1: USB disconnect, device number 73 [ 1015.499390][T11729] usb 6-1: ath9k_htc: USB layer deinitialized [ 1015.521656][ T9328] usb 1-1: USB disconnect, device number 79 [ 1015.616105][ T3670] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1015.625295][ T3670] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.638827][ T3670] usb 4-1: Product: syz [ 1015.642992][ T3670] usb 4-1: Manufacturer: syz [ 1015.653286][ T3670] usb 4-1: SerialNumber: syz 23:07:40 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x0, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1015.696390][ T3670] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1015.806085][T11790] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1015.886083][T11671] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1015.895192][T11671] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.906205][T11671] usb 3-1: Product: syz [ 1015.910812][T11671] usb 3-1: Manufacturer: syz [ 1015.915656][T11671] usb 3-1: SerialNumber: syz [ 1015.958702][T11671] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:41 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x0, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1016.006049][T11729] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 1016.058047][T11743] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1016.069736][T11743] ath9k_htc: Failed to initialize the device [ 1016.075908][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1016.266020][ T3670] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1016.326317][T11790] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1016.335387][T11790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.349469][T11790] usb 5-1: Product: syz [ 1016.353619][T11790] usb 5-1: Manufacturer: syz [ 1016.363406][T11790] usb 5-1: SerialNumber: syz [ 1016.376010][ T55] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1016.382904][ T55] ath9k_htc: Failed to initialize the device [ 1016.394999][ T9328] usb 1-1: ath9k_htc: USB layer deinitialized [ 1016.406283][T11790] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1016.436008][T12487] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 1016.468740][T23314] usb 4-1: USB disconnect, device number 79 [ 1016.605999][T11729] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1016.615141][T11671] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1016.624635][T11729] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.635474][T11729] usb 6-1: Product: syz [ 1016.639696][T11729] usb 6-1: Manufacturer: syz [ 1016.644965][T11729] usb 6-1: SerialNumber: syz [ 1016.686463][T11729] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1016.775948][ T9328] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1016.808329][ T7] usb 3-1: USB disconnect, device number 105 23:07:42 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1016.955922][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1016.965089][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.973365][ T9760] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1016.982522][T12487] usb 2-1: Product: syz [ 1016.987880][T12487] usb 2-1: Manufacturer: syz [ 1017.006454][T12487] usb 2-1: SerialNumber: syz [ 1017.076252][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1017.175035][ T9028] usb 5-1: USB disconnect, device number 90 23:07:42 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1017.325885][T11729] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1017.335841][ T3670] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1017.342776][ T3670] ath9k_htc: Failed to initialize the device [ 1017.356640][ T9328] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1017.367426][T23314] usb 4-1: ath9k_htc: USB layer deinitialized [ 1017.376846][ T9328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.385320][ T9328] usb 1-1: Product: syz [ 1017.392355][ T9328] usb 1-1: Manufacturer: syz [ 1017.399384][ T9328] usb 1-1: SerialNumber: syz [ 1017.456169][ T9328] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:42 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1017.645864][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1017.655890][T11671] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1017.662809][T11671] ath9k_htc: Failed to initialize the device [ 1017.669428][ T7] usb 3-1: ath9k_htc: USB layer deinitialized [ 1017.738271][T23314] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1017.848058][T11743] usb 2-1: USB disconnect, device number 78 [ 1018.045839][ T7] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1018.055782][ T9760] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1018.064030][ T9760] ath9k_htc: Failed to initialize the device [ 1018.071724][ T9028] usb 5-1: ath9k_htc: USB layer deinitialized [ 1018.079177][ T9328] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1018.281647][ T55] usb 1-1: USB disconnect, device number 80 [ 1018.315851][T23314] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 23:07:43 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x0, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1018.324933][T23314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.339030][T23314] usb 4-1: Product: syz [ 1018.343184][T23314] usb 4-1: Manufacturer: syz [ 1018.354565][T23314] usb 4-1: SerialNumber: syz [ 1018.376178][T11729] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1018.384214][T11729] ath9k_htc: Failed to initialize the device [ 1018.396509][T23314] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1018.466025][ T9028] usb 5-1: new high-speed USB device number 91 using dummy_hcd 23:07:43 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x0, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1018.539815][T23314] usb 6-1: USB disconnect, device number 74 [ 1018.566142][T23314] usb 6-1: ath9k_htc: USB layer deinitialized [ 1018.646207][ T7] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1018.655273][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.668635][ T7] usb 3-1: Product: syz [ 1018.672828][ T7] usb 3-1: Manufacturer: syz [ 1018.683020][ T7] usb 3-1: SerialNumber: syz [ 1018.697411][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1018.704351][T12487] ath9k_htc: Failed to initialize the device [ 1018.710518][T11743] usb 2-1: ath9k_htc: USB layer deinitialized [ 1018.727689][ T7] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:44 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x0, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1019.016190][T23314] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1019.065676][T11743] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 1019.077361][ T9028] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1019.087655][ T9028] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.095933][ T9328] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1019.104072][ T9328] ath9k_htc: Failed to initialize the device [ 1019.110108][T11605] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1019.119106][ T9028] usb 5-1: Product: syz [ 1019.124810][ T9028] usb 5-1: Manufacturer: syz [ 1019.131112][ T9028] usb 5-1: SerialNumber: syz [ 1019.131130][ T55] usb 1-1: ath9k_htc: USB layer deinitialized [ 1019.176436][ T9028] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1019.311417][ T9760] usb 4-1: USB disconnect, device number 80 [ 1019.365670][ T7] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1019.475613][ T55] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 1019.565836][T23314] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1019.575584][T23314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.579743][T11790] usb 3-1: USB disconnect, device number 106 [ 1019.583571][T23314] usb 6-1: Product: syz [ 1019.583586][T23314] usb 6-1: Manufacturer: syz [ 1019.583598][T23314] usb 6-1: SerialNumber: syz [ 1019.589937][T11743] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1019.614744][T11743] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.623914][T11743] usb 2-1: Product: syz [ 1019.630107][T11743] usb 2-1: Manufacturer: syz [ 1019.634768][T11743] usb 2-1: SerialNumber: syz [ 1019.636387][T23314] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1019.687862][T11743] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:45 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1019.795587][ T9028] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1019.997918][T12487] usb 5-1: USB disconnect, device number 91 [ 1020.007113][ T55] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1020.017966][ T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1020.027345][ T55] usb 1-1: Product: syz [ 1020.031593][ T55] usb 1-1: Manufacturer: syz [ 1020.039204][ T55] usb 1-1: SerialNumber: syz 23:07:45 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1020.085967][ T55] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1020.145520][T11605] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1020.152497][T11605] ath9k_htc: Failed to initialize the device [ 1020.173340][ T9760] usb 4-1: ath9k_htc: USB layer deinitialized [ 1020.255578][T11743] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1020.305613][T23314] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1020.375540][ T7] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1020.382518][ T7] ath9k_htc: Failed to initialize the device [ 1020.393949][T11790] usb 3-1: ath9k_htc: USB layer deinitialized 23:07:45 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1020.458773][ T17] usb 2-1: USB disconnect, device number 79 [ 1020.525488][ T9760] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1020.655492][ T55] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1020.745455][T11790] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1020.866996][ T9028] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1020.873875][ T9028] ath9k_htc: Failed to initialize the device [ 1020.880263][T12487] usb 5-1: ath9k_htc: USB layer deinitialized [ 1020.888259][T11729] usb 1-1: USB disconnect, device number 81 23:07:46 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x0, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1021.045466][ T9760] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1021.054565][ T9760] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.064196][ T9760] usb 4-1: Product: syz [ 1021.070125][ T9760] usb 4-1: Manufacturer: syz [ 1021.076183][ T9760] usb 4-1: SerialNumber: syz [ 1021.115664][ T9760] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1021.245448][T12487] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1021.265620][T11790] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1021.274800][T11790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.282820][T11790] usb 3-1: Product: syz [ 1021.287684][T11790] usb 3-1: Manufacturer: syz [ 1021.292981][T11790] usb 3-1: SerialNumber: syz 23:07:46 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x0, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1021.335401][T11743] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1021.335404][T23314] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1021.335425][T11743] ath9k_htc: Failed to initialize the device [ 1021.342439][T23314] ath9k_htc: Failed to initialize the device [ 1021.349425][T11790] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1021.372414][ T17] usb 2-1: ath9k_htc: USB layer deinitialized 23:07:46 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x0, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1021.570476][T11671] usb 6-1: USB disconnect, device number 75 [ 1021.586283][T11671] usb 6-1: ath9k_htc: USB layer deinitialized [ 1021.705365][ T9760] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1021.725492][ T17] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1021.735356][ T55] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1021.742984][ T55] ath9k_htc: Failed to initialize the device [ 1021.750691][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 1021.765443][T12487] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1021.774733][T12487] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.784648][T12487] usb 5-1: Product: syz [ 1021.790578][T12487] usb 5-1: Manufacturer: syz [ 1021.797782][T12487] usb 5-1: SerialNumber: syz [ 1021.835738][T12487] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1021.912203][T15666] usb 4-1: USB disconnect, device number 81 [ 1021.935420][T11790] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1022.065297][T11671] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1022.125287][T11729] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1022.138583][ T3670] usb 3-1: USB disconnect, device number 107 [ 1022.245410][ T17] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1022.254466][ T17] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1022.264123][ T17] usb 2-1: Product: syz [ 1022.270695][ T17] usb 2-1: Manufacturer: syz [ 1022.277074][ T17] usb 2-1: SerialNumber: syz [ 1022.315808][ T17] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:47 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1022.395360][T12487] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1022.597832][ T9028] usb 5-1: USB disconnect, device number 92 [ 1022.625298][T11671] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1022.634982][T11671] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1022.643081][T11671] usb 6-1: Product: syz 23:07:47 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1022.647351][T11671] usb 6-1: Manufacturer: syz [ 1022.651961][T11671] usb 6-1: SerialNumber: syz [ 1022.695465][T11671] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1022.703737][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1022.714271][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1022.726746][T11729] usb 1-1: Product: syz [ 1022.731123][T11729] usb 1-1: Manufacturer: syz [ 1022.736441][T11729] usb 1-1: SerialNumber: syz [ 1022.775232][ T9760] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1022.788944][ T9760] ath9k_htc: Failed to initialize the device [ 1022.794980][T15666] usb 4-1: ath9k_htc: USB layer deinitialized [ 1022.805440][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1022.885207][ T17] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1023.015195][T11790] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1023.022222][T11790] ath9k_htc: Failed to initialize the device [ 1023.034037][ T3670] usb 3-1: ath9k_htc: USB layer deinitialized 23:07:48 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1023.096516][ T7] usb 2-1: USB disconnect, device number 80 [ 1023.155162][T15666] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1023.365172][T11671] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1023.395173][ T3670] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1023.415162][T12487] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1023.422095][T12487] ath9k_htc: Failed to initialize the device [ 1023.429549][ T9028] usb 5-1: ath9k_htc: USB layer deinitialized [ 1023.438852][T11729] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:48 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x0, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1023.650220][T11743] usb 1-1: USB disconnect, device number 82 [ 1023.675417][T15666] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1023.684634][T15666] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.694141][T15666] usb 4-1: Product: syz [ 1023.698967][T15666] usb 4-1: Manufacturer: syz [ 1023.704345][T15666] usb 4-1: SerialNumber: syz [ 1023.745706][T15666] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1023.815163][ T9028] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1023.895116][ T17] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1023.902009][ T17] ath9k_htc: Failed to initialize the device [ 1023.908069][ T7] usb 2-1: ath9k_htc: USB layer deinitialized [ 1023.916238][ T3670] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1023.925671][ T3670] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.933700][ T3670] usb 3-1: Product: syz [ 1023.939429][ T3670] usb 3-1: Manufacturer: syz [ 1023.944017][ T3670] usb 3-1: SerialNumber: syz [ 1023.985418][ T3670] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:49 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x0, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1024.315096][ T7] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 1024.328315][T15666] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1024.375015][T11671] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1024.381960][T11671] ath9k_htc: Failed to initialize the device [ 1024.388334][ T9028] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1024.399540][ T9028] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1024.407824][ T9028] usb 5-1: Product: syz [ 1024.411980][ T9028] usb 5-1: Manufacturer: syz [ 1024.416742][ T9028] usb 5-1: SerialNumber: syz [ 1024.455216][T11729] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1024.462116][T11729] ath9k_htc: Failed to initialize the device [ 1024.468376][ T9028] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1024.478877][T11743] usb 1-1: ath9k_htc: USB layer deinitialized [ 1024.537234][T12487] usb 4-1: USB disconnect, device number 82 [ 1024.545232][ T3670] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:49 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x0, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1024.607362][ T9760] usb 6-1: USB disconnect, device number 76 [ 1024.627160][ T9760] usb 6-1: ath9k_htc: USB layer deinitialized [ 1024.747430][T10944] usb 3-1: USB disconnect, device number 108 [ 1024.834962][T11743] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1024.945022][ T7] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1024.954269][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1024.962296][ T7] usb 2-1: Product: syz [ 1024.967554][ T7] usb 2-1: Manufacturer: syz [ 1024.972338][ T7] usb 2-1: SerialNumber: syz 23:07:50 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1025.015331][ T7] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1025.074958][ T9760] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 1025.154970][ T9028] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:50 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1025.354994][T11743] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1025.365232][T11743] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.367291][T23314] usb 5-1: USB disconnect, device number 93 [ 1025.374545][T11743] usb 1-1: Product: syz [ 1025.399390][T11743] usb 1-1: Manufacturer: syz [ 1025.404169][T11743] usb 1-1: SerialNumber: syz [ 1025.415563][T15666] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1025.422433][T15666] ath9k_htc: Failed to initialize the device [ 1025.436647][T12487] usb 4-1: ath9k_htc: USB layer deinitialized [ 1025.446784][T11743] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1025.574928][ T3670] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1025.581865][ T3670] ath9k_htc: Failed to initialize the device [ 1025.590759][T10944] usb 3-1: ath9k_htc: USB layer deinitialized [ 1025.606399][ T9760] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1025.615507][ T9760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.623532][ T9760] usb 6-1: Product: syz [ 1025.631141][ T9760] usb 6-1: Manufacturer: syz [ 1025.636315][ T9760] usb 6-1: SerialNumber: syz [ 1025.656246][ T7] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1025.676881][ T9760] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1025.784923][T12487] usb 4-1: new high-speed USB device number 83 using dummy_hcd 23:07:51 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1025.858175][T11671] usb 2-1: USB disconnect, device number 81 [ 1025.945425][T10944] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1026.024860][T11743] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1026.214790][ T9028] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1026.221903][ T9028] ath9k_htc: Failed to initialize the device [ 1026.233154][T23314] usb 5-1: ath9k_htc: USB layer deinitialized [ 1026.236878][ T55] usb 1-1: USB disconnect, device number 83 [ 1026.245570][ T9760] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:07:51 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x0, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1026.304889][T12487] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1026.314197][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.322851][T12487] usb 4-1: Product: syz [ 1026.327028][T12487] usb 4-1: Manufacturer: syz [ 1026.332167][T12487] usb 4-1: SerialNumber: syz [ 1026.375047][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1026.474862][T10944] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1026.483954][T10944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.492466][T10944] usb 3-1: Product: syz [ 1026.497805][T10944] usb 3-1: Manufacturer: syz [ 1026.502791][T10944] usb 3-1: SerialNumber: syz [ 1026.545441][T10944] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1026.614767][T23314] usb 5-1: new high-speed USB device number 94 using dummy_hcd 23:07:52 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x0, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1026.694746][ T7] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1026.701835][ T7] ath9k_htc: Failed to initialize the device [ 1026.714114][T11671] usb 2-1: ath9k_htc: USB layer deinitialized [ 1026.944774][T12487] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1027.084717][T11671] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1027.094760][T11743] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1027.102933][T11743] ath9k_htc: Failed to initialize the device [ 1027.109658][ T55] usb 1-1: ath9k_htc: USB layer deinitialized [ 1027.117136][T10944] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1027.147138][T15666] usb 4-1: USB disconnect, device number 83 [ 1027.195304][T23314] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1027.204373][T23314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.213725][T23314] usb 5-1: Product: syz [ 1027.218838][T23314] usb 5-1: Manufacturer: syz [ 1027.223525][T23314] usb 5-1: SerialNumber: syz [ 1027.264939][T23314] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1027.318881][ T9028] usb 3-1: USB disconnect, device number 109 [ 1027.340671][ T9760] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1027.347626][ T9760] ath9k_htc: Failed to initialize the device [ 1027.474783][ T55] usb 1-1: new high-speed USB device number 84 using dummy_hcd 23:07:52 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x0, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') 23:07:52 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1027.637293][T11605] usb 6-1: USB disconnect, device number 77 [ 1027.658124][T11605] usb 6-1: ath9k_htc: USB layer deinitialized [ 1027.706698][T11671] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1027.716123][T11671] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.728599][T11671] usb 2-1: Product: syz [ 1027.739224][T11671] usb 2-1: Manufacturer: syz [ 1027.744560][T11671] usb 2-1: SerialNumber: syz 23:07:53 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1027.795135][T11671] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1027.924680][T23314] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1027.974604][T12487] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1027.981608][T12487] ath9k_htc: Failed to initialize the device [ 1027.993304][T15666] usb 4-1: ath9k_htc: USB layer deinitialized [ 1027.999863][ T55] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1028.014821][ T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.022821][ T55] usb 1-1: Product: syz [ 1028.027242][ T55] usb 1-1: Manufacturer: syz [ 1028.033867][ T55] usb 1-1: SerialNumber: syz [ 1028.074850][ T55] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1028.114688][T11605] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 1028.128842][T11743] usb 5-1: USB disconnect, device number 94 [ 1028.134867][T10944] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1028.141784][T10944] ath9k_htc: Failed to initialize the device [ 1028.155095][ T9028] usb 3-1: ath9k_htc: USB layer deinitialized [ 1028.354588][T15666] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1028.434573][T11671] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1028.554579][ T9028] usb 3-1: new high-speed USB device number 110 using dummy_hcd 23:07:53 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1028.634570][ T55] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1028.639076][ T7] usb 2-1: USB disconnect, device number 82 [ 1028.664517][T11605] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1028.673762][T11605] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.696815][T11605] usb 6-1: Product: syz [ 1028.700984][T11605] usb 6-1: Manufacturer: syz [ 1028.707396][T11605] usb 6-1: SerialNumber: syz [ 1028.744781][T11605] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1028.848595][ T9760] usb 1-1: USB disconnect, device number 84 [ 1028.874511][T15666] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1028.883582][T15666] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.897566][T15666] usb 4-1: Product: syz [ 1028.901715][T15666] usb 4-1: Manufacturer: syz [ 1028.912187][T15666] usb 4-1: SerialNumber: syz [ 1028.944559][T23314] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1028.951504][T23314] ath9k_htc: Failed to initialize the device [ 1028.954742][T15666] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1028.974866][T11743] usb 5-1: ath9k_htc: USB layer deinitialized 23:07:54 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x0, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1029.134513][ T9028] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1029.143698][ T9028] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.157775][ T9028] usb 3-1: Product: syz [ 1029.172189][ T9028] usb 3-1: Manufacturer: syz [ 1029.177091][ T9028] usb 3-1: SerialNumber: syz [ 1029.225064][ T9028] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:54 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x0, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1029.324451][T11743] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1029.404462][T11729] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1029.494432][T11671] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1029.501322][T11671] ath9k_htc: Failed to initialize the device [ 1029.513247][ T7] usb 2-1: ath9k_htc: USB layer deinitialized [ 1029.544453][T15666] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1029.654394][ T55] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1029.661377][ T55] ath9k_htc: Failed to initialize the device [ 1029.667627][ T9760] usb 1-1: ath9k_htc: USB layer deinitialized [ 1029.747269][T11605] usb 4-1: USB disconnect, device number 84 [ 1029.844397][T11743] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1029.853483][T11743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.861731][T11743] usb 5-1: Product: syz [ 1029.865036][ T9028] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1029.867356][T11743] usb 5-1: Manufacturer: syz [ 1029.881610][T11743] usb 5-1: SerialNumber: syz [ 1029.894569][ T7] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1029.924652][T11743] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1030.024353][ T9760] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1030.069229][T23314] usb 3-1: USB disconnect, device number 110 23:07:55 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1030.454310][T11729] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1030.461376][T11729] ath9k_htc: Failed to initialize the device [ 1030.475264][ T7] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1030.484526][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.484656][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1030.492494][ T7] usb 2-1: Product: syz [ 1030.492507][ T7] usb 2-1: Manufacturer: syz [ 1030.492516][ T7] usb 2-1: SerialNumber: syz [ 1030.534845][ T7] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:55 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1030.554589][ T9760] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1030.563801][ T9760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.580127][ T9760] usb 1-1: Product: syz [ 1030.587122][ T9760] usb 1-1: Manufacturer: syz [ 1030.598971][ T9760] usb 1-1: SerialNumber: syz [ 1030.615896][T15666] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1030.622805][T15666] ath9k_htc: Failed to initialize the device [ 1030.638439][T11605] usb 4-1: ath9k_htc: USB layer deinitialized [ 1030.649131][ T9760] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:55 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x0, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1030.688037][ T55] usb 5-1: USB disconnect, device number 95 [ 1030.705826][ T9328] usb 6-1: USB disconnect, device number 78 [ 1030.721579][ T9328] usb 6-1: ath9k_htc: USB layer deinitialized [ 1030.934285][ T9028] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1030.941286][ T9028] ath9k_htc: Failed to initialize the device [ 1030.947346][T23314] usb 3-1: ath9k_htc: USB layer deinitialized [ 1031.014308][T11605] usb 4-1: new high-speed USB device number 85 using dummy_hcd 23:07:56 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1031.214225][ T7] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1031.223273][ T9328] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 1031.224256][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1031.334263][T23314] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1031.417446][T10944] usb 2-1: USB disconnect, device number 83 [ 1031.444258][ T3670] usb 1-1: USB disconnect, device number 85 [ 1031.574165][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1031.581312][T11743] ath9k_htc: Failed to initialize the device [ 1031.589003][ T55] usb 5-1: ath9k_htc: USB layer deinitialized [ 1031.604298][T11605] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1031.613968][T11605] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.623468][T11605] usb 4-1: Product: syz [ 1031.629090][T11605] usb 4-1: Manufacturer: syz [ 1031.633796][T11605] usb 4-1: SerialNumber: syz [ 1031.684529][T11605] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1031.794174][ T9328] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1031.803418][ T9328] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.813248][ T9328] usb 6-1: Product: syz [ 1031.819030][ T9328] usb 6-1: Manufacturer: syz [ 1031.823654][ T9328] usb 6-1: SerialNumber: syz [ 1031.865092][ T9328] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:57 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x0, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:07:57 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x0, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1031.934165][T23314] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1031.943444][T23314] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.947705][ T55] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1031.976706][T23314] usb 3-1: Product: syz [ 1031.981156][T23314] usb 3-1: Manufacturer: syz [ 1031.988878][T23314] usb 3-1: SerialNumber: syz [ 1032.034984][T23314] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1032.294140][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1032.294177][ T7] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1032.304438][ T9760] ath9k_htc: Failed to initialize the device [ 1032.308706][ T7] ath9k_htc: Failed to initialize the device [ 1032.313891][ T3670] usb 1-1: ath9k_htc: USB layer deinitialized [ 1032.320333][T11605] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1032.339051][T10944] usb 2-1: ath9k_htc: USB layer deinitialized [ 1032.494084][ T55] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1032.503531][ T55] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1032.517670][ T55] usb 5-1: Product: syz [ 1032.523894][ T55] usb 5-1: Manufacturer: syz [ 1032.534378][ T55] usb 5-1: SerialNumber: syz [ 1032.539730][T12487] usb 4-1: USB disconnect, device number 85 [ 1032.544588][ T9328] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1032.594333][ T55] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1032.674110][T23314] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1032.714036][T10944] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1032.721671][ T3670] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1032.876177][ T5] usb 3-1: USB disconnect, device number 111 23:07:58 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1033.174111][ T55] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1033.234051][T10944] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1033.243305][T10944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.254299][ T3670] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1033.263431][ T3670] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.271686][T10944] usb 2-1: Product: syz [ 1033.275983][T10944] usb 2-1: Manufacturer: syz [ 1033.280686][T10944] usb 2-1: SerialNumber: syz [ 1033.285463][ T3670] usb 1-1: Product: syz [ 1033.290427][ T3670] usb 1-1: Manufacturer: syz [ 1033.295951][ T3670] usb 1-1: SerialNumber: syz [ 1033.334262][T10944] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1033.344596][ T3670] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:58 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1033.377874][T10944] usb 5-1: USB disconnect, device number 96 [ 1033.414046][T11605] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1033.422032][T11605] ath9k_htc: Failed to initialize the device [ 1033.433836][T12487] usb 4-1: ath9k_htc: USB layer deinitialized [ 1033.584019][ T9328] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1033.591060][ T9328] ath9k_htc: Failed to initialize the device 23:07:59 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x0, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1033.744037][T23314] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1033.751075][T23314] ath9k_htc: Failed to initialize the device [ 1033.759968][ T5] usb 3-1: ath9k_htc: USB layer deinitialized [ 1033.771345][T15666] usb 6-1: USB disconnect, device number 79 [ 1033.786315][T15666] usb 6-1: ath9k_htc: USB layer deinitialized [ 1033.795077][T12487] usb 4-1: new high-speed USB device number 86 using dummy_hcd 23:07:59 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1033.913924][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1033.923655][ T3670] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1034.116919][ T7] usb 2-1: USB disconnect, device number 84 [ 1034.124200][T11729] usb 1-1: USB disconnect, device number 86 [ 1034.133881][ T5] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1034.213909][ T55] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1034.220843][ T55] ath9k_htc: Failed to initialize the device [ 1034.226882][T10944] usb 5-1: ath9k_htc: USB layer deinitialized [ 1034.243853][T15666] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1034.333931][T12487] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1034.343084][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.352905][T12487] usb 4-1: Product: syz [ 1034.358303][T12487] usb 4-1: Manufacturer: syz [ 1034.363371][T12487] usb 4-1: SerialNumber: syz [ 1034.404255][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:07:59 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x0, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:07:59 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x0, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1034.593847][T10944] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1034.684177][ T5] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1034.693360][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.705645][ T5] usb 3-1: Product: syz [ 1034.711647][ T5] usb 3-1: Manufacturer: syz [ 1034.718404][ T5] usb 3-1: SerialNumber: syz [ 1034.763834][T15666] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1034.772973][T15666] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.783464][T15666] usb 6-1: Product: syz [ 1034.784692][ T5] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1034.789002][T15666] usb 6-1: Manufacturer: syz [ 1034.802691][T15666] usb 6-1: SerialNumber: syz [ 1034.844349][T15666] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1034.933836][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1034.940973][ T9760] ath9k_htc: Failed to initialize the device [ 1034.947381][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 1034.973893][T12487] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1035.013863][ T3670] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1035.020812][ T3670] ath9k_htc: Failed to initialize the device [ 1035.032635][ T7] usb 2-1: ath9k_htc: USB layer deinitialized [ 1035.133892][T10944] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1035.143194][T10944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.152643][T10944] usb 5-1: Product: syz [ 1035.158873][T10944] usb 5-1: Manufacturer: syz [ 1035.164211][T10944] usb 5-1: SerialNumber: syz [ 1035.182199][ T9328] usb 4-1: USB disconnect, device number 86 [ 1035.204166][T10944] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1035.323751][T11729] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1035.403731][ T7] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1035.415571][T15666] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1035.425487][ T5] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1035.627131][T11743] usb 3-1: USB disconnect, device number 112 23:08:00 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1035.783778][T10944] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1035.883772][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1035.892925][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.901066][T11729] usb 1-1: Product: syz [ 1035.906107][T11729] usb 1-1: Manufacturer: syz [ 1035.911106][T11729] usb 1-1: SerialNumber: syz [ 1035.954285][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1035.974607][ T7] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1035.983885][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.993269][ T7] usb 2-1: Product: syz [ 1035.993696][ T9760] usb 5-1: USB disconnect, device number 97 [ 1036.003658][ T7] usb 2-1: Manufacturer: syz [ 1036.008474][ T7] usb 2-1: SerialNumber: syz [ 1036.053672][T12487] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1036.060673][T12487] ath9k_htc: Failed to initialize the device [ 1036.064206][ T7] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1036.074852][ T9328] usb 4-1: ath9k_htc: USB layer deinitialized 23:08:01 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:01 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1036.453637][ T5] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1036.455491][T15666] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1036.460551][ T9328] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1036.469982][T15666] ath9k_htc: Failed to initialize the device [ 1036.483592][ T5] ath9k_htc: Failed to initialize the device [ 1036.489644][T11743] usb 3-1: ath9k_htc: USB layer deinitialized [ 1036.613649][T11729] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1036.733589][ T7] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:02 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x0, 0x0, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1036.817457][ T3670] usb 6-1: USB disconnect, device number 80 [ 1036.829316][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized [ 1036.829667][T23314] usb 1-1: USB disconnect, device number 87 [ 1036.843587][T11743] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1036.863604][T10944] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1036.870488][T10944] ath9k_htc: Failed to initialize the device [ 1036.877130][ T9760] usb 5-1: ath9k_htc: USB layer deinitialized [ 1036.937300][T11605] usb 2-1: USB disconnect, device number 85 [ 1037.053587][ T9328] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1037.062952][ T9328] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.072473][ T9328] usb 4-1: Product: syz [ 1037.078394][ T9328] usb 4-1: Manufacturer: syz [ 1037.083078][ T9328] usb 4-1: SerialNumber: syz [ 1037.133927][ T9328] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1037.233516][ T9760] usb 5-1: new high-speed USB device number 98 using dummy_hcd 23:08:02 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x0, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1037.283510][ T3670] usb 6-1: new high-speed USB device number 81 using dummy_hcd 23:08:02 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x0, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1037.393973][T11743] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1037.403111][T11743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.416839][T11743] usb 3-1: Product: syz [ 1037.421015][T11743] usb 3-1: Manufacturer: syz [ 1037.431038][T11743] usb 3-1: SerialNumber: syz [ 1037.474309][T11743] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1037.663512][T11729] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1037.670716][T11729] ath9k_htc: Failed to initialize the device [ 1037.676895][T23314] usb 1-1: ath9k_htc: USB layer deinitialized [ 1037.753480][ T9760] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1037.762562][ T9760] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.776507][ T9760] usb 5-1: Product: syz [ 1037.780674][ T9760] usb 5-1: Manufacturer: syz [ 1037.790678][ T9760] usb 5-1: SerialNumber: syz [ 1037.804977][ T9328] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1037.814471][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1037.815679][ T7] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1037.825383][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.830678][ T7] ath9k_htc: Failed to initialize the device [ 1037.843723][ T9760] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1037.847003][T11605] usb 2-1: ath9k_htc: USB layer deinitialized [ 1037.867082][ T3670] usb 6-1: Product: syz [ 1037.876374][ T3670] usb 6-1: Manufacturer: syz [ 1037.885695][ T3670] usb 6-1: SerialNumber: syz [ 1037.925148][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1038.007600][T15666] usb 4-1: USB disconnect, device number 87 [ 1038.063428][T23314] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1038.063491][T12487] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1038.233426][T11605] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1038.274430][ T9028] usb 3-1: USB disconnect, device number 113 [ 1038.443403][ T9760] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:03 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1038.493443][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1038.643414][T23314] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1038.646821][T11743] usb 5-1: USB disconnect, device number 98 [ 1038.655916][T23314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.667384][T23314] usb 1-1: Product: syz [ 1038.672430][T23314] usb 1-1: Manufacturer: syz [ 1038.677278][T23314] usb 1-1: SerialNumber: syz 23:08:04 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1038.733624][T23314] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1038.824762][T11605] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1038.834810][T11605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.849706][T11605] usb 2-1: Product: syz [ 1038.857384][ T9328] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1038.866505][ T9328] ath9k_htc: Failed to initialize the device [ 1038.872563][T11605] usb 2-1: Manufacturer: syz [ 1038.872576][T15666] usb 4-1: ath9k_htc: USB layer deinitialized [ 1038.885935][T11605] usb 2-1: SerialNumber: syz [ 1038.943627][T11605] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1039.093381][T12487] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1039.093412][T12487] ath9k_htc: Failed to initialize the device [ 1039.100421][ T9028] usb 3-1: ath9k_htc: USB layer deinitialized 23:08:04 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1039.233983][T15666] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1039.353343][T23314] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1039.463332][ T9028] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1039.493353][ T9760] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1039.500350][ T9760] ath9k_htc: Failed to initialize the device [ 1039.508281][T11743] usb 5-1: ath9k_htc: USB layer deinitialized [ 1039.566503][T10944] usb 1-1: USB disconnect, device number 88 [ 1039.573409][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1039.579756][T11605] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1039.580762][ T3670] ath9k_htc: Failed to initialize the device [ 1039.753315][T15666] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1039.762470][T15666] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1039.772116][T15666] usb 4-1: Product: syz [ 1039.783421][T15666] usb 4-1: Manufacturer: syz [ 1039.788054][T15666] usb 4-1: SerialNumber: syz [ 1039.794294][ T55] usb 2-1: USB disconnect, device number 86 23:08:05 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1039.833529][T15666] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1039.864723][T11743] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1039.865679][ T9328] usb 6-1: USB disconnect, device number 81 [ 1039.884163][ T9328] usb 6-1: ath9k_htc: USB layer deinitialized [ 1040.023207][ T9028] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1040.032341][ T9028] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.040492][ T9028] usb 3-1: Product: syz [ 1040.045764][ T9028] usb 3-1: Manufacturer: syz [ 1040.050426][ T9028] usb 3-1: SerialNumber: syz 23:08:05 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1040.103539][ T9028] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:05 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x0, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1040.353169][ T9328] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 1040.373176][T23314] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1040.380062][T23314] ath9k_htc: Failed to initialize the device [ 1040.383166][T11743] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1040.395726][T10944] usb 1-1: ath9k_htc: USB layer deinitialized [ 1040.401813][T15666] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1040.415900][T11743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.428024][T11743] usb 5-1: Product: syz [ 1040.432591][T11743] usb 5-1: Manufacturer: syz [ 1040.437205][T11743] usb 5-1: SerialNumber: syz [ 1040.483538][T11743] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1040.613145][T11605] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1040.616107][T11790] usb 4-1: USB disconnect, device number 88 [ 1040.621476][T11605] ath9k_htc: Failed to initialize the device [ 1040.640041][ T55] usb 2-1: ath9k_htc: USB layer deinitialized [ 1040.713124][ T9028] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1040.753122][T10944] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1040.913190][ T9328] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1040.919356][ T9760] usb 3-1: USB disconnect, device number 114 [ 1040.922396][ T9328] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.922415][ T9328] usb 6-1: Product: syz [ 1040.941346][ T9328] usb 6-1: Manufacturer: syz [ 1040.946260][ T9328] usb 6-1: SerialNumber: syz [ 1040.983396][ T9328] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1040.993370][ T55] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1041.053122][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:06 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1041.255828][T11729] usb 5-1: USB disconnect, device number 99 [ 1041.273714][T10944] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1041.282839][T10944] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.292542][T10944] usb 1-1: Product: syz [ 1041.299574][T10944] usb 1-1: Manufacturer: syz [ 1041.305905][T10944] usb 1-1: SerialNumber: syz [ 1041.343602][T10944] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:06 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1041.413035][T15666] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1041.428290][T15666] ath9k_htc: Failed to initialize the device [ 1041.440631][T11790] usb 4-1: ath9k_htc: USB layer deinitialized [ 1041.523040][ T55] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1041.532216][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.542066][ T55] usb 2-1: Product: syz [ 1041.547635][ T55] usb 2-1: Manufacturer: syz [ 1041.552538][ T55] usb 2-1: SerialNumber: syz [ 1041.593597][ T55] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1041.613036][ T9328] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:07 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1041.743059][ T9028] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1041.750006][ T9028] ath9k_htc: Failed to initialize the device [ 1041.756081][ T9760] usb 3-1: ath9k_htc: USB layer deinitialized [ 1041.803264][T11790] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1041.912988][T10944] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1042.112949][ T9760] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1042.116108][T23314] usb 1-1: USB disconnect, device number 89 [ 1042.133050][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1042.144489][T11743] ath9k_htc: Failed to initialize the device [ 1042.151512][T11729] usb 5-1: ath9k_htc: USB layer deinitialized [ 1042.163024][ T55] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1042.322992][T11790] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1042.332153][T11790] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1042.342040][T11790] usb 4-1: Product: syz [ 1042.348335][T11790] usb 4-1: Manufacturer: syz [ 1042.354289][T11790] usb 4-1: SerialNumber: syz [ 1042.366478][ T5] usb 2-1: USB disconnect, device number 87 [ 1042.393422][T11790] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1042.522954][T11729] usb 5-1: new high-speed USB device number 100 using dummy_hcd 23:08:07 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1042.643017][ T9760] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1042.663242][ T9760] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1042.682917][ T9760] usb 3-1: Product: syz [ 1042.687366][ T9760] usb 3-1: Manufacturer: syz [ 1042.691963][ T9760] usb 3-1: SerialNumber: syz [ 1042.703012][ T9328] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1042.715229][ T9328] ath9k_htc: Failed to initialize the device [ 1042.733248][ T9760] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:08 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x0, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:08 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1042.908280][ T9028] usb 6-1: USB disconnect, device number 82 [ 1042.923364][ T9028] usb 6-1: ath9k_htc: USB layer deinitialized [ 1042.933810][T10944] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1042.943153][T10944] ath9k_htc: Failed to initialize the device [ 1042.949463][T23314] usb 1-1: ath9k_htc: USB layer deinitialized [ 1042.972869][T11790] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1043.092906][T11729] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1043.102178][T11729] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1043.111853][T11729] usb 5-1: Product: syz [ 1043.117184][T11729] usb 5-1: Manufacturer: syz [ 1043.123259][T11729] usb 5-1: SerialNumber: syz [ 1043.174584][T11729] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1043.176097][T12487] usb 4-1: USB disconnect, device number 89 [ 1043.252822][ T55] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1043.259717][ T55] ath9k_htc: Failed to initialize the device [ 1043.271139][ T5] usb 2-1: ath9k_htc: USB layer deinitialized [ 1043.302838][ T9760] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1043.342849][T23314] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1043.432875][ T9028] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1043.505581][T15666] usb 3-1: USB disconnect, device number 115 23:08:08 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1043.652868][ T5] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1043.882797][ T7] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:09 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1043.972837][T23314] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1043.982023][T23314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1043.991364][T23314] usb 1-1: Product: syz [ 1043.998353][T23314] usb 1-1: Manufacturer: syz [ 1044.004400][T23314] usb 1-1: SerialNumber: syz [ 1044.013452][ T9028] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1044.033282][ T9028] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1044.048564][ T9028] usb 6-1: Product: syz [ 1044.053007][T11790] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1044.054786][T23314] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1044.060873][T11790] ath9k_htc: Failed to initialize the device [ 1044.068973][ T9028] usb 6-1: Manufacturer: syz [ 1044.077401][T12487] usb 4-1: ath9k_htc: USB layer deinitialized [ 1044.082046][ T9028] usb 6-1: SerialNumber: syz [ 1044.092166][ T3670] usb 5-1: USB disconnect, device number 100 [ 1044.153171][ T9028] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1044.222769][ T5] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1044.231859][ T5] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1044.239880][ T5] usb 2-1: Product: syz [ 1044.244588][ T5] usb 2-1: Manufacturer: syz [ 1044.250828][ T5] usb 2-1: SerialNumber: syz [ 1044.293079][ T5] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1044.372687][ T9760] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1044.379735][ T9760] ath9k_htc: Failed to initialize the device [ 1044.387458][T15666] usb 3-1: ath9k_htc: USB layer deinitialized [ 1044.432700][T12487] usb 4-1: new high-speed USB device number 90 using dummy_hcd 23:08:09 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1044.742645][T15666] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1044.762672][T23314] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1044.822723][ T9028] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1044.922637][ T5] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1044.932784][ T7] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1044.949152][ T7] ath9k_htc: Failed to initialize the device [ 1044.952643][T12487] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1044.964335][ T3670] usb 5-1: ath9k_htc: USB layer deinitialized [ 1044.984982][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1044.995860][T12487] usb 4-1: Product: syz [ 1045.000145][T12487] usb 4-1: Manufacturer: syz [ 1045.008049][T12487] usb 4-1: SerialNumber: syz [ 1045.015025][T10944] usb 1-1: USB disconnect, device number 90 [ 1045.062950][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1045.125523][T11729] usb 2-1: USB disconnect, device number 88 [ 1045.282764][T15666] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1045.292009][T15666] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1045.307325][T15666] usb 3-1: Product: syz [ 1045.311488][T15666] usb 3-1: Manufacturer: syz [ 1045.321917][T15666] usb 3-1: SerialNumber: syz [ 1045.330528][ T3670] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1045.373109][T15666] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:10 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:10 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x0, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1045.632797][T12487] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1045.812616][T23314] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1045.819610][T23314] ath9k_htc: Failed to initialize the device [ 1045.828661][T10944] usb 1-1: ath9k_htc: USB layer deinitialized [ 1045.845743][ T9328] usb 4-1: USB disconnect, device number 90 [ 1045.860227][ T3670] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1045.869462][ T3670] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1045.877469][ T3670] usb 5-1: Product: syz [ 1045.882810][ T3670] usb 5-1: Manufacturer: syz [ 1045.887632][ T3670] usb 5-1: SerialNumber: syz [ 1045.893493][ T9028] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1045.900762][ T9028] ath9k_htc: Failed to initialize the device [ 1045.932970][ T3670] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1045.948995][T15666] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1045.972523][ T5] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1045.979415][ T5] ath9k_htc: Failed to initialize the device [ 1045.985630][T11729] usb 2-1: ath9k_htc: USB layer deinitialized 23:08:11 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1046.037330][ T3670] usb 6-1: USB disconnect, device number 83 [ 1046.054668][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized [ 1046.150868][ T7] usb 3-1: USB disconnect, device number 116 [ 1046.182506][T10944] usb 1-1: new high-speed USB device number 91 using dummy_hcd 23:08:11 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1046.373009][T11729] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1046.462521][ T3670] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 1046.492508][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:11 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1046.692471][T12487] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1046.696696][T11671] usb 5-1: USB disconnect, device number 101 [ 1046.699358][T12487] ath9k_htc: Failed to initialize the device [ 1046.711685][ T9328] usb 4-1: ath9k_htc: USB layer deinitialized [ 1046.712405][T10944] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1046.752571][T10944] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.760800][T10944] usb 1-1: Product: syz [ 1046.765607][T10944] usb 1-1: Manufacturer: syz [ 1046.772235][T10944] usb 1-1: SerialNumber: syz [ 1046.822698][T10944] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1046.932426][T11729] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1046.941542][T11729] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.949682][T11729] usb 2-1: Product: syz [ 1046.954095][T11729] usb 2-1: Manufacturer: syz [ 1046.959584][T11729] usb 2-1: SerialNumber: syz [ 1047.002420][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1047.011658][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1047.012687][T11729] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1047.022503][T15666] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1047.043271][T15666] ath9k_htc: Failed to initialize the device [ 1047.049306][ T3670] usb 6-1: Product: syz [ 1047.056099][ T3670] usb 6-1: Manufacturer: syz [ 1047.061729][ T3670] usb 6-1: SerialNumber: syz [ 1047.062883][ T7] usb 3-1: ath9k_htc: USB layer deinitialized [ 1047.074018][ T9328] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1047.113920][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:12 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1047.392370][T10944] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1047.442863][ T7] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1047.572389][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1047.579438][T11743] ath9k_htc: Failed to initialize the device [ 1047.588435][T11671] usb 5-1: ath9k_htc: USB layer deinitialized [ 1047.603117][T23314] usb 1-1: USB disconnect, device number 91 [ 1047.652380][T11729] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1047.661404][ T9328] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1047.670949][ T9328] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1047.678966][ T9328] usb 4-1: Product: syz [ 1047.682370][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1047.683359][ T9328] usb 4-1: Manufacturer: syz [ 1047.696854][ T9328] usb 4-1: SerialNumber: syz [ 1047.752615][ T9328] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1047.856574][ T9328] usb 2-1: USB disconnect, device number 89 [ 1047.972275][T11671] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1048.032312][ T7] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1048.041513][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.051011][ T7] usb 3-1: Product: syz [ 1048.057447][ T7] usb 3-1: Manufacturer: syz [ 1048.062465][ T7] usb 3-1: SerialNumber: syz 23:08:13 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, 0x0, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1048.111736][ T7] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:13 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1048.442286][ T5] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1048.452276][T10944] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1048.459734][T10944] ath9k_htc: Failed to initialize the device [ 1048.468185][T23314] usb 1-1: ath9k_htc: USB layer deinitialized [ 1048.572283][T11671] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1048.581709][T11671] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.595118][T11671] usb 5-1: Product: syz [ 1048.599271][T11671] usb 5-1: Manufacturer: syz [ 1048.609718][T11671] usb 5-1: SerialNumber: syz [ 1048.649987][ T9028] usb 4-1: USB disconnect, device number 91 [ 1048.656485][T11671] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1048.693718][T11729] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1048.700597][T11729] ath9k_htc: Failed to initialize the device [ 1048.713621][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 1048.772199][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1048.772306][ T7] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1048.780017][ T3670] ath9k_htc: Failed to initialize the device [ 1048.852262][T23314] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1048.982016][ T3704] usb 3-1: USB disconnect, device number 117 23:08:14 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1049.065460][T11605] usb 6-1: USB disconnect, device number 84 [ 1049.086330][T11605] usb 6-1: ath9k_htc: USB layer deinitialized [ 1049.092467][ T9328] usb 2-1: new high-speed USB device number 90 using dummy_hcd 23:08:14 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1049.322190][T11671] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1049.422405][T23314] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1049.431624][T23314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.446183][T23314] usb 1-1: Product: syz [ 1049.450342][T23314] usb 1-1: Manufacturer: syz [ 1049.460566][T23314] usb 1-1: SerialNumber: syz 23:08:14 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1049.492234][ T5] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1049.512480][T23314] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1049.521717][T11605] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1049.531986][T10944] usb 5-1: USB disconnect, device number 102 [ 1049.543124][ T5] ath9k_htc: Failed to initialize the device [ 1049.549324][ T9028] usb 4-1: ath9k_htc: USB layer deinitialized [ 1049.692109][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1049.701246][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.715056][ T9328] usb 2-1: Product: syz [ 1049.719321][ T9328] usb 2-1: Manufacturer: syz [ 1049.729526][ T9328] usb 2-1: SerialNumber: syz [ 1049.772392][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1049.822120][ T7] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1049.829108][ T7] ath9k_htc: Failed to initialize the device [ 1049.840520][ T3704] usb 3-1: ath9k_htc: USB layer deinitialized [ 1049.932091][ T9028] usb 4-1: new high-speed USB device number 92 using dummy_hcd 23:08:15 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1050.132112][T11605] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1050.141268][T11605] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.155368][T11605] usb 6-1: Product: syz [ 1050.159804][T11605] usb 6-1: Manufacturer: syz [ 1050.169551][T11605] usb 6-1: SerialNumber: syz [ 1050.212157][ T3704] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1050.219867][T23314] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1050.229200][T11605] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1050.372137][T11671] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1050.379149][T11671] ath9k_htc: Failed to initialize the device [ 1050.390652][T10944] usb 5-1: ath9k_htc: USB layer deinitialized [ 1050.402066][ T9328] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1050.418125][T15666] usb 1-1: USB disconnect, device number 92 [ 1050.512077][ T9028] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1050.521178][ T9028] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.530901][ T9028] usb 4-1: Product: syz [ 1050.536743][ T9028] usb 4-1: Manufacturer: syz [ 1050.541419][ T9028] usb 4-1: SerialNumber: syz [ 1050.582300][ T9028] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1050.604813][ T3670] usb 2-1: USB disconnect, device number 90 [ 1050.741955][T10944] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1050.791968][ T3704] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1050.801123][ T3704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.809132][ T3704] usb 3-1: Product: syz [ 1050.814306][ T3704] usb 3-1: Manufacturer: syz [ 1050.819639][ T3704] usb 3-1: SerialNumber: syz [ 1050.862283][ T3704] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1050.870441][T13386] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:16 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, 0x0, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:16 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1051.242026][ T9028] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1051.251907][T23314] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1051.258937][T23314] ath9k_htc: Failed to initialize the device [ 1051.263057][T10944] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1051.274426][T15666] usb 1-1: ath9k_htc: USB layer deinitialized [ 1051.282683][T10944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1051.292294][T10944] usb 5-1: Product: syz [ 1051.297020][T10944] usb 5-1: Manufacturer: syz [ 1051.301662][T10944] usb 5-1: SerialNumber: syz [ 1051.343461][T10944] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1051.411874][ T9328] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1051.418803][ T9328] ath9k_htc: Failed to initialize the device [ 1051.427792][ T3670] usb 2-1: ath9k_htc: USB layer deinitialized [ 1051.445985][T11671] usb 4-1: USB disconnect, device number 92 [ 1051.531947][ T3704] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1051.641855][T15666] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1051.735209][T11729] usb 3-1: USB disconnect, device number 118 [ 1051.781875][ T3670] usb 2-1: new high-speed USB device number 91 using dummy_hcd 23:08:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1051.892055][T13386] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1051.899941][T13386] ath9k_htc: Failed to initialize the device [ 1051.911847][T10944] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:17 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1052.095531][T11743] usb 6-1: USB disconnect, device number 85 [ 1052.107977][T11743] usb 6-1: ath9k_htc: USB layer deinitialized [ 1052.117226][ T5] usb 5-1: USB disconnect, device number 103 [ 1052.162955][T15666] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1052.172110][T15666] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.180224][T15666] usb 1-1: Product: syz [ 1052.186515][T15666] usb 1-1: Manufacturer: syz [ 1052.192793][T15666] usb 1-1: SerialNumber: syz 23:08:17 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1052.232088][T15666] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1052.291813][ T9028] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1052.298834][ T9028] ath9k_htc: Failed to initialize the device [ 1052.313384][ T3670] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1052.314225][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 1052.329565][ T3670] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.340429][ T3670] usb 2-1: Product: syz [ 1052.345023][ T3670] usb 2-1: Manufacturer: syz [ 1052.359649][ T3670] usb 2-1: SerialNumber: syz [ 1052.402394][ T3670] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1052.571768][T11743] usb 6-1: new high-speed USB device number 86 using dummy_hcd 23:08:17 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1052.621770][ T3704] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1052.628685][ T3704] ath9k_htc: Failed to initialize the device [ 1052.641303][T11729] usb 3-1: ath9k_htc: USB layer deinitialized [ 1052.711773][T11671] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1052.801767][T15666] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1052.931739][T10944] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1052.938835][T10944] ath9k_htc: Failed to initialize the device [ 1052.947636][ T5] usb 5-1: ath9k_htc: USB layer deinitialized [ 1052.971997][ T3670] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1053.005549][ T9760] usb 1-1: USB disconnect, device number 93 [ 1053.021784][T11729] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1053.091802][T11743] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1053.100884][T11743] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.110428][T11743] usb 6-1: Product: syz [ 1053.116658][T11743] usb 6-1: Manufacturer: syz [ 1053.121813][T11743] usb 6-1: SerialNumber: syz [ 1053.161915][T11743] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1053.184161][T12487] usb 2-1: USB disconnect, device number 91 [ 1053.281699][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1053.290927][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.304811][T11671] usb 4-1: Product: syz [ 1053.309037][T11671] usb 4-1: Manufacturer: syz [ 1053.318976][T11671] usb 4-1: SerialNumber: syz [ 1053.331684][ T5] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1053.371963][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:18 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, 0x0, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1053.601667][T11729] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1053.610790][T11729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.620263][T11729] usb 3-1: Product: syz [ 1053.627085][T11729] usb 3-1: Manufacturer: syz [ 1053.633237][T11729] usb 3-1: SerialNumber: syz 23:08:18 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1053.673412][T11729] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1053.722863][T11743] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1053.811661][T15666] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1053.818560][T15666] ath9k_htc: Failed to initialize the device [ 1053.831725][ T9760] usb 1-1: ath9k_htc: USB layer deinitialized [ 1053.911662][ T5] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1053.920917][ T5] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.930311][ T5] usb 5-1: Product: syz [ 1053.936856][ T5] usb 5-1: Manufacturer: syz [ 1053.942405][ T5] usb 5-1: SerialNumber: syz [ 1053.991636][T11671] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1054.001002][ T5] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1054.051657][ T3670] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1054.060648][ T3670] ath9k_htc: Failed to initialize the device [ 1054.071992][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1054.181596][ T9760] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 1054.197840][T23314] usb 4-1: USB disconnect, device number 93 [ 1054.311681][T11729] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1054.421548][T12487] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1054.513879][ T55] usb 3-1: USB disconnect, device number 119 [ 1054.621541][ T5] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:20 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1054.701565][ T9760] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1054.710712][ T9760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.721936][ T9760] usb 1-1: Product: syz [ 1054.726156][ T9760] usb 1-1: Manufacturer: syz [ 1054.734622][ T9760] usb 1-1: SerialNumber: syz [ 1054.771573][T11743] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1054.778503][T11743] ath9k_htc: Failed to initialize the device [ 1054.784975][ T9760] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1054.824267][T15666] usb 5-1: USB disconnect, device number 104 [ 1054.961499][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1054.970699][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.986116][T12487] usb 2-1: Product: syz [ 1054.990419][T12487] usb 2-1: Manufacturer: syz [ 1055.002431][T12487] usb 2-1: SerialNumber: syz 23:08:20 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1055.011515][T11671] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1055.020355][T11671] ath9k_htc: Failed to initialize the device [ 1055.033734][T23314] usb 4-1: ath9k_htc: USB layer deinitialized [ 1055.049070][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:20 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1055.143931][ T3670] usb 6-1: USB disconnect, device number 86 [ 1055.158394][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized 23:08:20 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1055.341448][T11729] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1055.350157][T11729] ath9k_htc: Failed to initialize the device [ 1055.362457][ T55] usb 3-1: ath9k_htc: USB layer deinitialized [ 1055.373269][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1055.431449][T23314] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1055.575831][ T9028] usb 1-1: USB disconnect, device number 94 [ 1055.611439][ T3670] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1055.623222][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1055.661484][ T5] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1055.668548][ T5] ath9k_htc: Failed to initialize the device [ 1055.674594][T15666] usb 5-1: ath9k_htc: USB layer deinitialized [ 1055.731787][ T55] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1055.825275][T13386] usb 2-1: USB disconnect, device number 92 23:08:21 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x0, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1056.031386][T15666] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1056.031932][T23314] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1056.048899][T23314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.058249][T23314] usb 4-1: Product: syz [ 1056.063436][T23314] usb 4-1: Manufacturer: syz [ 1056.068125][T23314] usb 4-1: SerialNumber: syz [ 1056.131611][T23314] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1056.132048][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1056.169688][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.178016][ T3670] usb 6-1: Product: syz [ 1056.184213][ T3670] usb 6-1: Manufacturer: syz [ 1056.190309][ T3670] usb 6-1: SerialNumber: syz [ 1056.231550][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1056.251419][ T55] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1056.260689][ T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.271706][ T55] usb 3-1: Product: syz [ 1056.275959][ T55] usb 3-1: Manufacturer: syz [ 1056.280891][ T55] usb 3-1: SerialNumber: syz 23:08:21 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1056.322060][ T55] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1056.451332][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1056.458342][ T9760] ath9k_htc: Failed to initialize the device [ 1056.469573][ T9028] usb 1-1: ath9k_htc: USB layer deinitialized [ 1056.561344][T15666] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1056.570400][T15666] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.580135][T15666] usb 5-1: Product: syz [ 1056.585490][T15666] usb 5-1: Manufacturer: syz [ 1056.590988][T15666] usb 5-1: SerialNumber: syz [ 1056.631568][T15666] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1056.691344][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1056.699335][T12487] ath9k_htc: Failed to initialize the device [ 1056.711534][T13386] usb 2-1: ath9k_htc: USB layer deinitialized [ 1056.801287][T23314] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1056.812852][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1056.841285][ T9028] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1056.891295][ T55] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1057.004084][T11729] usb 4-1: USB disconnect, device number 94 [ 1057.091335][T13386] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1057.100888][ T5] usb 3-1: USB disconnect, device number 120 [ 1057.201296][T15666] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1057.412004][ T9028] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1057.415390][T11743] usb 5-1: USB disconnect, device number 105 [ 1057.421061][ T9028] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.421080][ T9028] usb 1-1: Product: syz [ 1057.421089][ T9028] usb 1-1: Manufacturer: syz [ 1057.421099][ T9028] usb 1-1: SerialNumber: syz [ 1057.453383][ T9028] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:22 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:22 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1057.661235][T13386] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1057.670408][T13386] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.681901][T13386] usb 2-1: Product: syz [ 1057.687139][T13386] usb 2-1: Manufacturer: syz [ 1057.694139][T13386] usb 2-1: SerialNumber: syz [ 1057.732093][T13386] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1057.811178][T23314] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1057.818139][T23314] ath9k_htc: Failed to initialize the device [ 1057.825763][T11729] usb 4-1: ath9k_htc: USB layer deinitialized 23:08:23 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1057.891168][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1057.898328][ T3670] ath9k_htc: Failed to initialize the device [ 1057.971206][ T55] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1057.978237][ T55] ath9k_htc: Failed to initialize the device [ 1057.992064][ T5] usb 3-1: ath9k_htc: USB layer deinitialized [ 1058.071189][ T9028] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:23 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1058.172608][T12487] usb 6-1: USB disconnect, device number 87 [ 1058.187842][T12487] usb 6-1: ath9k_htc: USB layer deinitialized [ 1058.203533][T11729] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1058.211141][T15666] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1058.211163][T15666] ath9k_htc: Failed to initialize the device [ 1058.234397][T11743] usb 5-1: ath9k_htc: USB layer deinitialized [ 1058.276345][T11671] usb 1-1: USB disconnect, device number 95 [ 1058.361130][ T5] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1058.371285][T13386] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1058.573488][T12487] usb 2-1: USB disconnect, device number 93 [ 1058.601102][T11743] usb 5-1: new high-speed USB device number 106 using dummy_hcd 23:08:24 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x0, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1058.791099][T11729] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1058.803501][T11729] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1058.811830][T11729] usb 4-1: Product: syz [ 1058.817612][T11729] usb 4-1: Manufacturer: syz [ 1058.823751][T11729] usb 4-1: SerialNumber: syz [ 1058.881417][T11729] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1058.931098][ T5] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1058.940316][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1058.950207][ T5] usb 3-1: Product: syz [ 1058.956269][ T5] usb 3-1: Manufacturer: syz [ 1058.964556][ T5] usb 3-1: SerialNumber: syz [ 1059.001712][ T5] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:24 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1059.091164][ T9028] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1059.098207][ T9028] ath9k_htc: Failed to initialize the device [ 1059.105831][T11671] usb 1-1: ath9k_htc: USB layer deinitialized [ 1059.121200][T11743] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1059.130378][T11743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.138485][T11743] usb 5-1: Product: syz [ 1059.145277][T11743] usb 5-1: Manufacturer: syz [ 1059.151297][T11743] usb 5-1: SerialNumber: syz [ 1059.191299][T11743] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1059.411024][T13386] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1059.419881][T13386] ath9k_htc: Failed to initialize the device [ 1059.431264][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1059.481015][T11671] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 1059.541017][T11729] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1059.661057][ T5] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1059.743462][ T3704] usb 4-1: USB disconnect, device number 95 [ 1059.760980][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1059.781029][T12487] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1059.864444][T23314] usb 3-1: USB disconnect, device number 121 [ 1059.963662][ T7] usb 5-1: USB disconnect, device number 106 [ 1060.040966][T11671] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1060.050057][T11671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1060.059493][T11671] usb 1-1: Product: syz [ 1060.065310][T11671] usb 1-1: Manufacturer: syz [ 1060.071438][T11671] usb 1-1: SerialNumber: syz [ 1060.111278][T11671] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:25 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1060.301221][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1060.312458][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1060.320549][T12487] usb 2-1: Product: syz [ 1060.327711][T12487] usb 2-1: Manufacturer: syz [ 1060.333880][T12487] usb 2-1: SerialNumber: syz 23:08:25 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1060.381140][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:25 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1060.610854][T11729] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1060.617775][T11729] ath9k_htc: Failed to initialize the device [ 1060.629269][ T3704] usb 4-1: ath9k_htc: USB layer deinitialized [ 1060.690846][ T5] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1060.697965][ T5] ath9k_htc: Failed to initialize the device [ 1060.711209][T23314] usb 3-1: ath9k_htc: USB layer deinitialized [ 1060.761537][T11671] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1060.770849][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1060.782946][T11743] ath9k_htc: Failed to initialize the device [ 1060.789033][ T7] usb 5-1: ath9k_htc: USB layer deinitialized [ 1060.950824][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1060.966743][ T9028] usb 1-1: USB disconnect, device number 96 [ 1060.992499][ T3704] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1061.090785][T23314] usb 3-1: new high-speed USB device number 122 using dummy_hcd 23:08:26 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1061.163449][T15666] usb 2-1: USB disconnect, device number 94 [ 1061.163467][ T7] usb 5-1: new high-speed USB device number 107 using dummy_hcd 23:08:26 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x0, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1061.531293][ T3704] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1061.540350][ T3704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.555283][ T3704] usb 4-1: Product: syz [ 1061.559441][ T3704] usb 4-1: Manufacturer: syz [ 1061.565754][ T3704] usb 4-1: SerialNumber: syz [ 1061.621223][ T3704] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1061.640778][T23314] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1061.649862][T23314] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.663521][T23314] usb 3-1: Product: syz 23:08:26 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, 0x0, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1061.667670][T23314] usb 3-1: Manufacturer: syz [ 1061.678163][T23314] usb 3-1: SerialNumber: syz [ 1061.721041][T23314] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1061.729286][ T7] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1061.739439][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.749029][ T7] usb 5-1: Product: syz [ 1061.754301][ T7] usb 5-1: Manufacturer: syz [ 1061.759979][ T7] usb 5-1: SerialNumber: syz [ 1061.810965][ T7] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1061.819205][T11671] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1061.828368][T11671] ath9k_htc: Failed to initialize the device [ 1061.836888][ T9028] usb 1-1: ath9k_htc: USB layer deinitialized [ 1061.970721][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1061.977638][T12487] ath9k_htc: Failed to initialize the device [ 1061.989632][T15666] usb 2-1: ath9k_htc: USB layer deinitialized [ 1062.210711][ T9028] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 1062.291074][ T3704] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1062.350661][T15666] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1062.410840][T23314] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1062.480803][ T7] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1062.495079][T11743] usb 4-1: USB disconnect, device number 96 [ 1062.613275][ T55] usb 3-1: USB disconnect, device number 122 [ 1062.686501][ T5] usb 5-1: USB disconnect, device number 107 [ 1062.790633][ T9028] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1062.799814][ T9028] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.814790][ T9028] usb 1-1: Product: syz [ 1062.819017][ T9028] usb 1-1: Manufacturer: syz [ 1062.829417][ T9028] usb 1-1: SerialNumber: syz [ 1062.870693][T15666] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1062.879752][T15666] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.887808][T15666] usb 2-1: Product: syz [ 1062.891374][ T9028] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1062.899000][T15666] usb 2-1: Manufacturer: syz [ 1062.909946][T15666] usb 2-1: SerialNumber: syz 23:08:28 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1062.960927][T15666] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:28 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:28 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1063.330654][ T3704] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1063.337521][ T3704] ath9k_htc: Failed to initialize the device [ 1063.349183][T11743] usb 4-1: ath9k_htc: USB layer deinitialized [ 1063.490573][ T7] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1063.497604][T23314] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1063.504488][T23314] ath9k_htc: Failed to initialize the device [ 1063.510478][ T7] ath9k_htc: Failed to initialize the device [ 1063.510521][ T55] usb 3-1: ath9k_htc: USB layer deinitialized [ 1063.521669][ T9028] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1063.522853][T15666] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1063.550551][ T5] usb 5-1: ath9k_htc: USB layer deinitialized [ 1063.700561][T11743] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1063.725710][T11671] usb 1-1: USB disconnect, device number 97 [ 1063.748688][T12487] usb 2-1: USB disconnect, device number 95 [ 1063.890490][ T55] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1063.940483][ T5] usb 5-1: new high-speed USB device number 108 using dummy_hcd 23:08:29 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') 23:08:29 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0x0, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:29 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1064.220492][T11743] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1064.229591][T11743] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.238130][T11743] usb 4-1: Product: syz [ 1064.243767][T11743] usb 4-1: Manufacturer: syz [ 1064.251396][T11743] usb 4-1: SerialNumber: syz [ 1064.300841][T11743] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1064.410484][ T55] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1064.419849][ T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.429661][ T55] usb 3-1: Product: syz [ 1064.436326][ T55] usb 3-1: Manufacturer: syz [ 1064.441854][ T55] usb 3-1: SerialNumber: syz [ 1064.481709][ T55] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1064.511931][ T5] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1064.521193][ T5] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1064.529306][ T5] usb 5-1: Product: syz [ 1064.540749][ T5] usb 5-1: Manufacturer: syz [ 1064.546683][ T5] usb 5-1: SerialNumber: syz [ 1064.590715][ T5] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1064.610743][T15666] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1064.611862][ T9028] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1064.617617][T15666] ath9k_htc: Failed to initialize the device [ 1064.625077][ T9028] ath9k_htc: Failed to initialize the device [ 1064.639075][T11671] usb 1-1: ath9k_htc: USB layer deinitialized [ 1064.644976][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1064.890456][ T3670] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1065.000434][T12487] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1065.020415][T11671] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1065.070372][ T55] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1065.101765][ T7] usb 4-1: USB disconnect, device number 97 [ 1065.250434][ T5] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1065.272347][T23314] usb 3-1: USB disconnect, device number 123 [ 1065.452372][ T3704] usb 5-1: USB disconnect, device number 108 [ 1065.520330][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1065.529681][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.537717][T12487] usb 2-1: Product: syz [ 1065.542672][T12487] usb 2-1: Manufacturer: syz [ 1065.547782][T12487] usb 2-1: SerialNumber: syz [ 1065.561537][T11671] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 23:08:30 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1065.572231][T11671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.581361][T11671] usb 1-1: Product: syz [ 1065.585670][T11671] usb 1-1: Manufacturer: syz [ 1065.590918][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1065.591287][T11671] usb 1-1: SerialNumber: syz [ 1065.690557][T11671] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:31 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:31 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1065.970274][ T3670] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1065.979181][ T3670] ath9k_htc: Failed to initialize the device [ 1065.993452][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 1066.130282][ T55] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1066.137779][ T55] ath9k_htc: Failed to initialize the device [ 1066.149298][T23314] usb 3-1: ath9k_htc: USB layer deinitialized [ 1066.160245][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1066.290294][ T5] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1066.297261][ T5] ath9k_htc: Failed to initialize the device [ 1066.309699][ T3704] usb 5-1: ath9k_htc: USB layer deinitialized [ 1066.315837][T11671] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1066.360347][ T7] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1066.364080][T11743] usb 2-1: USB disconnect, device number 96 [ 1066.519152][ T9028] usb 1-1: USB disconnect, device number 98 [ 1066.550293][T23314] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1066.710194][ T3704] usb 5-1: new high-speed USB device number 109 using dummy_hcd 23:08:32 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:32 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0x0, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1066.971522][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1066.980653][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.988671][ T7] usb 4-1: Product: syz [ 1066.994539][ T7] usb 4-1: Manufacturer: syz [ 1067.000824][ T7] usb 4-1: SerialNumber: syz [ 1067.050505][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1067.140220][T23314] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1067.149334][T23314] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1067.160786][T23314] usb 3-1: Product: syz [ 1067.165562][T23314] usb 3-1: Manufacturer: syz [ 1067.170775][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1067.170845][T23314] usb 3-1: SerialNumber: syz [ 1067.179469][T12487] ath9k_htc: Failed to initialize the device 23:08:32 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1067.194858][T11743] usb 2-1: ath9k_htc: USB layer deinitialized [ 1067.230378][T23314] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1067.300163][ T3704] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1067.309249][ T3704] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1067.320372][ T3704] usb 5-1: Product: syz [ 1067.324643][ T3704] usb 5-1: Manufacturer: syz [ 1067.329536][ T3704] usb 5-1: SerialNumber: syz [ 1067.334926][T11671] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1067.342445][T11671] ath9k_htc: Failed to initialize the device [ 1067.352940][ T9028] usb 1-1: ath9k_htc: USB layer deinitialized [ 1067.380399][ T3704] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1067.560077][T11743] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1067.600096][ T55] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1067.700122][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1067.750187][ T9028] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1067.880361][T23314] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1067.904176][T13386] usb 4-1: USB disconnect, device number 98 [ 1068.020167][ T3704] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1068.080071][T11743] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1068.084933][ T5] usb 3-1: USB disconnect, device number 124 [ 1068.090945][T11743] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.116846][T11743] usb 2-1: Product: syz [ 1068.122654][ T55] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1068.132903][T11743] usb 2-1: Manufacturer: syz [ 1068.137483][T11743] usb 2-1: SerialNumber: syz [ 1068.147107][ T55] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.157863][ T55] usb 6-1: Product: syz [ 1068.162499][ T55] usb 6-1: Manufacturer: syz [ 1068.169232][ T55] usb 6-1: SerialNumber: syz [ 1068.201613][T11743] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1068.221616][ T55] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1068.237778][T11729] usb 5-1: USB disconnect, device number 109 [ 1068.310077][ T9028] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1068.319214][ T9028] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.328870][ T9028] usb 1-1: Product: syz [ 1068.336087][ T9028] usb 1-1: Manufacturer: syz [ 1068.342999][ T9028] usb 1-1: SerialNumber: syz 23:08:33 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1068.390245][ T9028] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:33 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:34 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1068.770039][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1068.772225][T11743] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1068.776972][ T7] ath9k_htc: Failed to initialize the device [ 1068.805879][T13386] usb 4-1: ath9k_htc: USB layer deinitialized [ 1068.809966][ T55] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1068.939937][T23314] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1068.946960][T23314] ath9k_htc: Failed to initialize the device [ 1068.958516][ T5] usb 3-1: ath9k_htc: USB layer deinitialized [ 1068.995152][T12487] usb 2-1: USB disconnect, device number 97 [ 1069.029967][ T9028] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1069.099964][ T3704] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1069.107101][ T3704] ath9k_htc: Failed to initialize the device [ 1069.114646][T11729] usb 5-1: ath9k_htc: USB layer deinitialized [ 1069.180066][T13386] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1069.233690][T11790] usb 1-1: USB disconnect, device number 99 [ 1069.329923][ T5] usb 3-1: new high-speed USB device number 125 using dummy_hcd 23:08:34 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x0, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1069.499884][T11729] usb 5-1: new high-speed USB device number 110 using dummy_hcd 23:08:35 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0x0, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1069.739908][T13386] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1069.749148][T13386] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.766083][T13386] usb 4-1: Product: syz [ 1069.773511][T13386] usb 4-1: Manufacturer: syz [ 1069.778182][T13386] usb 4-1: SerialNumber: syz [ 1069.809875][T11743] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1069.816752][T11743] ath9k_htc: Failed to initialize the device [ 1069.830055][T13386] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1069.837463][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1069.889885][ T55] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1069.896999][ T55] ath9k_htc: Failed to initialize the device [ 1069.909878][ T5] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1069.920721][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.928702][ T5] usb 3-1: Product: syz [ 1069.932903][ T5] usb 3-1: Manufacturer: syz [ 1069.938392][ T5] usb 3-1: SerialNumber: syz [ 1069.980140][ T5] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1070.059875][ T9028] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1070.066893][ T9028] ath9k_htc: Failed to initialize the device [ 1070.075819][T11790] usb 1-1: ath9k_htc: USB layer deinitialized [ 1070.089899][T11729] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1070.098982][T11729] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1070.108562][T11729] usb 5-1: Product: syz [ 1070.114426][T11729] usb 5-1: Manufacturer: syz [ 1070.119125][T11729] usb 5-1: SerialNumber: syz [ 1070.160347][T11729] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1070.199883][T12487] usb 2-1: new high-speed USB device number 98 using dummy_hcd 23:08:35 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1070.288707][ T3670] usb 6-1: USB disconnect, device number 88 [ 1070.303616][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized [ 1070.429790][T11790] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1070.489797][T13386] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1070.649850][ T5] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1070.693796][ T3704] usb 4-1: USB disconnect, device number 99 [ 1070.720058][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1070.729239][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1070.741420][T12487] usb 2-1: Product: syz [ 1070.747643][T12487] usb 2-1: Manufacturer: syz [ 1070.753298][T12487] usb 2-1: SerialNumber: syz [ 1070.761172][ T3670] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 1070.809839][T11729] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1070.809997][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1070.852102][ T9328] usb 3-1: USB disconnect, device number 125 [ 1070.949735][T11790] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1070.959129][T11790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1070.973403][T11790] usb 1-1: Product: syz [ 1070.977570][T11790] usb 1-1: Manufacturer: syz [ 1070.988003][T11790] usb 1-1: SerialNumber: syz [ 1071.028822][ T7] usb 5-1: USB disconnect, device number 110 [ 1071.030152][T11790] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:36 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1071.279747][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1071.288855][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.298421][ T3670] usb 6-1: Product: syz [ 1071.305276][ T3670] usb 6-1: Manufacturer: syz [ 1071.310792][ T3670] usb 6-1: SerialNumber: syz 23:08:36 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1071.349946][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1071.381633][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:36 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1071.579672][T13386] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1071.588640][T13386] ath9k_htc: Failed to initialize the device [ 1071.599738][T11790] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1071.610696][ T3704] usb 4-1: ath9k_htc: USB layer deinitialized [ 1071.621987][T23314] usb 2-1: USB disconnect, device number 98 [ 1071.729651][ T5] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1071.736627][ T5] ath9k_htc: Failed to initialize the device [ 1071.748072][ T9328] usb 3-1: ath9k_htc: USB layer deinitialized [ 1071.802671][T11671] usb 1-1: USB disconnect, device number 100 [ 1071.889673][T11729] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1071.896615][T11729] ath9k_htc: Failed to initialize the device [ 1071.908589][ T7] usb 5-1: ath9k_htc: USB layer deinitialized [ 1071.919638][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1071.979667][ T3704] usb 4-1: new high-speed USB device number 100 using dummy_hcd 23:08:37 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1072.139965][ T9328] usb 3-1: new high-speed USB device number 126 using dummy_hcd 23:08:37 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x0, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1072.299619][ T7] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 1072.449598][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1072.456691][T12487] ath9k_htc: Failed to initialize the device [ 1072.462827][T23314] usb 2-1: ath9k_htc: USB layer deinitialized [ 1072.559607][ T3704] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1072.568753][ T3704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.578201][ T3704] usb 4-1: Product: syz [ 1072.584034][ T3704] usb 4-1: Manufacturer: syz [ 1072.588914][ T3704] usb 4-1: SerialNumber: syz [ 1072.629794][ T3704] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1072.689648][T11790] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1072.689649][ T9328] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1072.689670][ T9328] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.689686][ T9328] usb 3-1: Product: syz [ 1072.689698][ T9328] usb 3-1: Manufacturer: syz [ 1072.699244][T11790] ath9k_htc: Failed to initialize the device [ 1072.716626][ T9328] usb 3-1: SerialNumber: syz [ 1072.736751][T11671] usb 1-1: ath9k_htc: USB layer deinitialized [ 1072.780135][ T9328] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1072.829529][T23314] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1072.879625][ T7] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1072.888898][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.898687][ T7] usb 5-1: Product: syz [ 1072.906168][ T7] usb 5-1: Manufacturer: syz [ 1072.911969][ T7] usb 5-1: SerialNumber: syz [ 1072.962355][ T7] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1073.009982][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1073.017076][ T3670] ath9k_htc: Failed to initialize the device [ 1073.109540][T11671] usb 1-1: new high-speed USB device number 101 using dummy_hcd 23:08:38 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') [ 1073.319972][ T3704] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1073.323320][ T55] usb 6-1: USB disconnect, device number 89 [ 1073.355765][ T55] usb 6-1: ath9k_htc: USB layer deinitialized [ 1073.419891][T23314] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1073.429071][T23314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.439881][ T9328] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1073.449439][T23314] usb 2-1: Product: syz [ 1073.454091][T23314] usb 2-1: Manufacturer: syz [ 1073.459021][T23314] usb 2-1: SerialNumber: syz [ 1073.509804][T23314] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1073.526027][T12487] usb 4-1: USB disconnect, device number 100 [ 1073.626518][T11729] usb 3-1: USB disconnect, device number 126 [ 1073.645760][ T7] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1073.759425][ T55] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1073.759508][T11671] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1073.777609][T11671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.786751][T11671] usb 1-1: Product: syz [ 1073.791118][T11671] usb 1-1: Manufacturer: syz [ 1073.795694][T11671] usb 1-1: SerialNumber: syz [ 1073.839857][T11671] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1073.852233][ T5] usb 5-1: USB disconnect, device number 111 23:08:39 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:39 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1074.199950][T23314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1074.279404][ T55] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1074.288603][ T55] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.298320][ T55] usb 6-1: Product: syz [ 1074.303922][ T55] usb 6-1: Manufacturer: syz [ 1074.309263][ T55] usb 6-1: SerialNumber: syz 23:08:39 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1074.349595][ T55] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1074.371191][ T3704] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1074.380383][ T3704] ath9k_htc: Failed to initialize the device [ 1074.390373][T12487] usb 4-1: ath9k_htc: USB layer deinitialized [ 1074.405439][ T9028] usb 2-1: USB disconnect, device number 99 [ 1074.461013][ T9328] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1074.467923][ T9328] ath9k_htc: Failed to initialize the device [ 1074.479642][T11729] usb 3-1: ath9k_htc: USB layer deinitialized [ 1074.519353][T11671] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1074.689380][ T7] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1074.696276][ T7] ath9k_htc: Failed to initialize the device [ 1074.707917][ T5] usb 5-1: ath9k_htc: USB layer deinitialized [ 1074.724881][T11743] usb 1-1: USB disconnect, device number 101 [ 1074.739635][T12487] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1074.859299][T11729] usb 3-1: new high-speed USB device number 127 using dummy_hcd 23:08:40 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1074.919300][ T55] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1075.069273][ T5] usb 5-1: new high-speed USB device number 112 using dummy_hcd 23:08:40 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x0, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1075.249338][T23314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1075.256224][T23314] ath9k_htc: Failed to initialize the device [ 1075.259724][T12487] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1075.274439][ T9028] usb 2-1: ath9k_htc: USB layer deinitialized [ 1075.282206][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.293642][T12487] usb 4-1: Product: syz [ 1075.297855][T12487] usb 4-1: Manufacturer: syz [ 1075.304073][T12487] usb 4-1: SerialNumber: syz [ 1075.351632][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1075.449318][T11729] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1075.458446][T11729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.472462][T11729] usb 3-1: Product: syz [ 1075.476651][T11729] usb 3-1: Manufacturer: syz [ 1075.486274][T11729] usb 3-1: SerialNumber: syz [ 1075.529570][T11729] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1075.569234][T11671] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1075.576175][T11671] ath9k_htc: Failed to initialize the device [ 1075.587638][T11743] usb 1-1: ath9k_htc: USB layer deinitialized [ 1075.629209][ T9028] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1075.659236][ T5] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1075.668302][ T5] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.684090][ T5] usb 5-1: Product: syz [ 1075.688314][ T5] usb 5-1: Manufacturer: syz [ 1075.698643][ T5] usb 5-1: SerialNumber: syz [ 1075.739629][ T5] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1075.919273][T12487] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1075.939818][T11743] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1075.971841][ T55] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1075.978933][ T55] ath9k_htc: Failed to initialize the device [ 1076.121870][ T7] usb 4-1: USB disconnect, device number 101 [ 1076.139639][T11729] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1076.199219][ T9028] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1076.208434][ T9028] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.217964][ T9028] usb 2-1: Product: syz [ 1076.224340][ T9028] usb 2-1: Manufacturer: syz [ 1076.230832][ T9028] usb 2-1: SerialNumber: syz [ 1076.279459][ T9028] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:41 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1076.341947][T11790] usb 3-1: USB disconnect, device number 127 [ 1076.349808][ T5] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1076.373427][T13386] usb 6-1: USB disconnect, device number 90 [ 1076.386244][T13386] usb 6-1: ath9k_htc: USB layer deinitialized [ 1076.460684][T11743] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1076.469770][T11743] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.477940][T11743] usb 1-1: Product: syz [ 1076.489536][T11743] usb 1-1: Manufacturer: syz [ 1076.494937][T11743] usb 1-1: SerialNumber: syz [ 1076.539446][T11743] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1076.554731][T11671] usb 5-1: USB disconnect, device number 112 23:08:41 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:42 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x0, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1076.859110][T13386] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1076.959080][ T9028] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:42 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1077.009075][T12487] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1077.016018][T12487] ath9k_htc: Failed to initialize the device [ 1077.027743][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 1077.099132][T11743] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1077.162609][ T9328] usb 2-1: USB disconnect, device number 100 [ 1077.170453][T11729] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1077.178831][T11729] ath9k_htc: Failed to initialize the device [ 1077.191330][T11790] usb 3-1: ath9k_htc: USB layer deinitialized [ 1077.301528][ T9760] usb 1-1: USB disconnect, device number 102 [ 1077.389032][ T7] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1077.409042][ T5] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1077.415963][ T5] ath9k_htc: Failed to initialize the device [ 1077.429797][T11671] usb 5-1: ath9k_htc: USB layer deinitialized [ 1077.459090][T13386] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1077.469326][T13386] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1077.477316][T13386] usb 6-1: Product: syz [ 1077.489237][T13386] usb 6-1: Manufacturer: syz [ 1077.493835][T13386] usb 6-1: SerialNumber: syz [ 1077.539014][T11790] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1077.549341][T13386] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:42 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x0, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:43 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x0, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1077.799223][T11671] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1077.938999][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1077.948177][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1077.956419][ T7] usb 4-1: Product: syz [ 1077.961894][ T7] usb 4-1: Manufacturer: syz [ 1077.967866][ T7] usb 4-1: SerialNumber: syz [ 1077.972837][ T9028] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1077.980252][ T9028] ath9k_htc: Failed to initialize the device [ 1077.986952][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 1078.030580][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1078.059310][T11790] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1078.068373][T11790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.082021][T11790] usb 3-1: Product: syz [ 1078.086197][T11790] usb 3-1: Manufacturer: syz [ 1078.095889][T11790] usb 3-1: SerialNumber: syz [ 1078.128963][T11743] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1078.135879][T11743] ath9k_htc: Failed to initialize the device [ 1078.147702][T11790] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1078.155949][ T9760] usb 1-1: ath9k_htc: USB layer deinitialized [ 1078.180280][T13386] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1078.359097][T11671] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1078.368211][T11671] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.377752][ T9328] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1078.388659][T11671] usb 5-1: Product: syz [ 1078.392870][T11671] usb 5-1: Manufacturer: syz [ 1078.398068][T11671] usb 5-1: SerialNumber: syz [ 1078.439607][T11671] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1078.518908][ T9760] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1078.649015][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1078.728981][T12487] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1078.851215][ T55] usb 4-1: USB disconnect, device number 102 [ 1078.931312][ T5] usb 3-1: USB disconnect, device number 2 [ 1078.970265][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1078.979690][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.987682][ T9328] usb 2-1: Product: syz [ 1078.993430][ T9328] usb 2-1: Manufacturer: syz [ 1078.998638][ T9328] usb 2-1: SerialNumber: syz [ 1079.040847][ T9760] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1079.050075][ T9760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1079.058070][ T9760] usb 1-1: Product: syz [ 1079.062288][ T9760] usb 1-1: Manufacturer: syz [ 1079.067179][ T9760] usb 1-1: SerialNumber: syz [ 1079.070449][T11671] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1079.082291][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1079.109168][ T9760] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1079.248956][T13386] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1079.255977][T13386] ath9k_htc: Failed to initialize the device [ 1079.294932][T11743] usb 5-1: USB disconnect, device number 113 23:08:44 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:44 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1079.413717][T23314] usb 6-1: USB disconnect, device number 91 [ 1079.425014][T23314] usb 6-1: ath9k_htc: USB layer deinitialized 23:08:44 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x0, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1079.688815][ T9760] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1079.728836][ T9328] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1079.737941][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1079.744888][ T7] ath9k_htc: Failed to initialize the device [ 1079.754290][ T55] usb 4-1: ath9k_htc: USB layer deinitialized 23:08:45 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1079.809117][T12487] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1079.816109][T12487] ath9k_htc: Failed to initialize the device [ 1079.828981][ T5] usb 3-1: ath9k_htc: USB layer deinitialized [ 1079.891735][T15666] usb 1-1: USB disconnect, device number 103 [ 1079.930990][T11729] usb 2-1: USB disconnect, device number 101 [ 1079.968835][T23314] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1080.108746][ T55] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1080.138752][T11671] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1080.145656][T11671] ath9k_htc: Failed to initialize the device [ 1080.151720][T11743] usb 5-1: ath9k_htc: USB layer deinitialized [ 1080.178743][ T5] usb 3-1: new high-speed USB device number 3 using dummy_hcd 23:08:45 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x0, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:45 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1080.508758][T11743] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1080.522014][T23314] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1080.531426][T23314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.545641][T23314] usb 6-1: Product: syz [ 1080.552943][T23314] usb 6-1: Manufacturer: syz [ 1080.557538][T23314] usb 6-1: SerialNumber: syz [ 1080.619165][T23314] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1080.629293][ T55] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1080.640260][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.648306][ T55] usb 4-1: Product: syz [ 1080.652644][ T55] usb 4-1: Manufacturer: syz [ 1080.657886][ T55] usb 4-1: SerialNumber: syz [ 1080.699068][ T55] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1080.728704][ T5] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1080.737866][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.746086][ T5] usb 3-1: Product: syz [ 1080.750580][ T5] usb 3-1: Manufacturer: syz [ 1080.756428][ T5] usb 3-1: SerialNumber: syz [ 1080.768670][ T9328] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1080.773924][ T9760] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1080.776295][ T9328] ath9k_htc: Failed to initialize the device [ 1080.791548][T11729] usb 2-1: ath9k_htc: USB layer deinitialized [ 1080.792664][ T9760] ath9k_htc: Failed to initialize the device [ 1080.808964][ T5] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1080.833616][T15666] usb 1-1: ath9k_htc: USB layer deinitialized [ 1081.038652][T11743] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1081.047926][T11743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1081.057716][T11743] usb 5-1: Product: syz [ 1081.064108][T11743] usb 5-1: Manufacturer: syz [ 1081.070849][T11743] usb 5-1: SerialNumber: syz [ 1081.109323][T11743] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1081.158640][T11729] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1081.198631][T15666] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1081.258671][ T55] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1081.268816][T23314] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1081.461168][T11671] usb 4-1: USB disconnect, device number 103 [ 1081.476975][ T5] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1081.670626][T13386] usb 3-1: USB disconnect, device number 3 [ 1081.678672][T11743] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1081.698646][T11729] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1081.707691][T11729] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1081.721779][T11729] usb 2-1: Product: syz [ 1081.726016][T11729] usb 2-1: Manufacturer: syz [ 1081.729761][T15666] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1081.740322][T11729] usb 2-1: SerialNumber: syz [ 1081.742728][T15666] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1081.753227][T15666] usb 1-1: Product: syz [ 1081.757381][T15666] usb 1-1: Manufacturer: syz [ 1081.763615][T15666] usb 1-1: SerialNumber: syz [ 1081.798965][T11729] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1081.809859][T15666] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1081.880385][ T9760] usb 5-1: USB disconnect, device number 114 23:08:47 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:47 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x0, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1082.288515][ T55] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1082.288519][T23314] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1082.295658][ T55] ath9k_htc: Failed to initialize the device [ 1082.310882][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 1082.322173][T23314] ath9k_htc: Failed to initialize the device 23:08:47 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1082.388565][T15666] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1082.449179][T11729] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:47 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1082.490307][ T7] usb 6-1: USB disconnect, device number 92 [ 1082.508812][ T7] usb 6-1: ath9k_htc: USB layer deinitialized [ 1082.528541][ T5] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1082.535615][ T5] ath9k_htc: Failed to initialize the device [ 1082.547267][T13386] usb 3-1: ath9k_htc: USB layer deinitialized [ 1082.592089][T12487] usb 1-1: USB disconnect, device number 104 [ 1082.652756][ T3704] usb 2-1: USB disconnect, device number 102 [ 1082.698507][T11671] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1082.768448][T11743] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1082.775368][T11743] ath9k_htc: Failed to initialize the device [ 1082.782611][ T9760] usb 5-1: ath9k_htc: USB layer deinitialized [ 1082.948458][T13386] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1083.019039][ T7] usb 6-1: new high-speed USB device number 93 using dummy_hcd 23:08:48 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x0, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:48 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1083.138603][ T9760] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1083.238550][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1083.247664][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1083.261995][T11671] usb 4-1: Product: syz [ 1083.266306][T11671] usb 4-1: Manufacturer: syz [ 1083.276434][T11671] usb 4-1: SerialNumber: syz [ 1083.328748][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1083.408450][T15666] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1083.415934][T15666] ath9k_htc: Failed to initialize the device [ 1083.428517][T12487] usb 1-1: ath9k_htc: USB layer deinitialized [ 1083.498389][T11729] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1083.505398][T11729] ath9k_htc: Failed to initialize the device [ 1083.511594][ T3704] usb 2-1: ath9k_htc: USB layer deinitialized [ 1083.519247][T13386] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1083.532305][T13386] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1083.542505][T13386] usb 3-1: Product: syz [ 1083.547657][T13386] usb 3-1: Manufacturer: syz [ 1083.552769][T13386] usb 3-1: SerialNumber: syz [ 1083.589407][ T7] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1083.598590][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1083.606808][ T7] usb 6-1: Product: syz [ 1083.611613][T13386] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1083.621442][ T7] usb 6-1: Manufacturer: syz [ 1083.626035][ T7] usb 6-1: SerialNumber: syz [ 1083.668537][ T9760] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1083.668850][ T7] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1083.679848][ T9760] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1083.703584][ T9760] usb 5-1: Product: syz [ 1083.707893][ T9760] usb 5-1: Manufacturer: syz [ 1083.713975][ T9760] usb 5-1: SerialNumber: syz [ 1083.758642][ T9760] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1083.778365][T12487] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1083.908898][ T3704] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1083.988357][T11671] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1084.190757][ T5] usb 4-1: USB disconnect, device number 104 [ 1084.288363][T13386] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1084.298338][T12487] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1084.307444][T12487] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.315514][T12487] usb 1-1: Product: syz [ 1084.319873][ T9760] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1084.328893][T12487] usb 1-1: Manufacturer: syz [ 1084.334037][T12487] usb 1-1: SerialNumber: syz [ 1084.338333][ T7] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1084.378527][T12487] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1084.468366][ T3704] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1084.477651][ T3704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.491922][ T3704] usb 2-1: Product: syz [ 1084.496154][ T3704] usb 2-1: Manufacturer: syz [ 1084.496915][T11743] usb 3-1: USB disconnect, device number 4 [ 1084.513506][ T3704] usb 2-1: SerialNumber: syz [ 1084.522727][T15666] usb 5-1: USB disconnect, device number 115 [ 1084.558816][ T3704] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:08:49 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1084.949095][T12487] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:50 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x0, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:50 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1085.009770][T11671] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1085.016667][T11671] ath9k_htc: Failed to initialize the device [ 1085.026892][ T5] usb 4-1: ath9k_htc: USB layer deinitialized [ 1085.160984][T11729] usb 1-1: USB disconnect, device number 105 [ 1085.198265][ T3704] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1085.338307][T13386] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1085.345609][T13386] ath9k_htc: Failed to initialize the device [ 1085.357450][T11743] usb 3-1: ath9k_htc: USB layer deinitialized [ 1085.405751][T11790] usb 2-1: USB disconnect, device number 103 [ 1085.411938][ T9760] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1085.418168][ T7] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1085.421122][ T9760] ath9k_htc: Failed to initialize the device [ 1085.425645][ T5] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1085.432947][T15666] usb 5-1: ath9k_htc: USB layer deinitialized [ 1085.450716][ T7] ath9k_htc: Failed to initialize the device 23:08:50 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1085.561464][ T3670] usb 6-1: USB disconnect, device number 93 [ 1085.587985][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized 23:08:50 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x0, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1085.718124][T11743] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1085.798119][T15666] usb 5-1: new high-speed USB device number 116 using dummy_hcd 23:08:51 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x0, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1085.968123][T12487] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1085.975375][T12487] ath9k_htc: Failed to initialize the device [ 1085.987100][T11729] usb 1-1: ath9k_htc: USB layer deinitialized [ 1086.008377][ T5] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1086.017460][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.027247][ T5] usb 4-1: Product: syz [ 1086.033646][ T5] usb 4-1: Manufacturer: syz [ 1086.038382][ T3670] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1086.041038][ T5] usb 4-1: SerialNumber: syz [ 1086.090087][ T5] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1086.208103][ T3704] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1086.215456][ T3704] ath9k_htc: Failed to initialize the device [ 1086.226114][T11790] usb 2-1: ath9k_htc: USB layer deinitialized [ 1086.238185][T11743] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1086.247557][T11743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.256005][T11743] usb 3-1: Product: syz [ 1086.261630][T11743] usb 3-1: Manufacturer: syz [ 1086.267068][T11743] usb 3-1: SerialNumber: syz [ 1086.308310][T11743] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1086.319777][T15666] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1086.329766][T15666] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.337792][T15666] usb 5-1: Product: syz [ 1086.343769][T15666] usb 5-1: Manufacturer: syz [ 1086.349852][T15666] usb 5-1: SerialNumber: syz [ 1086.358099][T11729] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1086.388551][T15666] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1086.568081][ T3670] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1086.577273][ T3670] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.586956][T11790] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1086.596446][ T3670] usb 6-1: Product: syz [ 1086.600745][ T3670] usb 6-1: Manufacturer: syz [ 1086.605321][ T3670] usb 6-1: SerialNumber: syz [ 1086.648258][ T3670] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1086.698120][ T5] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1086.903116][ T7] usb 4-1: USB disconnect, device number 105 [ 1086.909268][T11743] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1086.938024][T11729] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1086.947115][T11729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.958347][T11729] usb 1-1: Product: syz [ 1086.962609][T11729] usb 1-1: Manufacturer: syz [ 1086.967241][T11729] usb 1-1: SerialNumber: syz [ 1086.968121][T15666] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1087.028313][T11729] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1087.111788][T11671] usb 3-1: USB disconnect, device number 5 [ 1087.138322][T11790] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1087.147418][T11790] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.155518][T11790] usb 2-1: Product: syz [ 1087.160335][T11790] usb 2-1: Manufacturer: syz [ 1087.165500][T11790] usb 2-1: SerialNumber: syz [ 1087.174127][T13386] usb 5-1: USB disconnect, device number 116 [ 1087.208472][T11790] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1087.222391][ T3670] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:52 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580)}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:52 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x0, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:52 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1087.670279][T11729] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1087.730357][ T5] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1087.737245][ T5] ath9k_htc: Failed to initialize the device [ 1087.752808][ T7] usb 4-1: ath9k_htc: USB layer deinitialized [ 1087.797992][T11790] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1087.872824][ T55] usb 1-1: USB disconnect, device number 106 [ 1087.967931][T11743] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1087.976617][T11743] ath9k_htc: Failed to initialize the device [ 1087.990055][T11671] usb 3-1: ath9k_htc: USB layer deinitialized [ 1088.004293][T12487] usb 2-1: USB disconnect, device number 104 [ 1088.049344][T15666] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1088.056224][T15666] ath9k_htc: Failed to initialize the device [ 1088.068344][T13386] usb 5-1: ath9k_htc: USB layer deinitialized [ 1088.117878][ T7] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1088.287866][ T3670] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1088.294749][ T3670] ath9k_htc: Failed to initialize the device 23:08:53 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x0, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1088.367850][T11671] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1088.447858][T13386] usb 5-1: new high-speed USB device number 117 using dummy_hcd 23:08:53 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) 23:08:53 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1088.597284][T23314] usb 6-1: USB disconnect, device number 94 [ 1088.605536][T23314] usb 6-1: ath9k_htc: USB layer deinitialized [ 1088.677902][ T7] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1088.687824][T11729] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1088.694741][T11729] ath9k_htc: Failed to initialize the device [ 1088.708787][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1088.716788][ T7] usb 4-1: Product: syz [ 1088.722460][ T7] usb 4-1: Manufacturer: syz [ 1088.727684][ T55] usb 1-1: ath9k_htc: USB layer deinitialized [ 1088.728744][ T7] usb 4-1: SerialNumber: syz [ 1088.788540][ T7] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1088.847808][T11790] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1088.854704][T11790] ath9k_htc: Failed to initialize the device [ 1088.862635][T12487] usb 2-1: ath9k_htc: USB layer deinitialized [ 1088.927910][T11671] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1088.937063][T11671] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1088.945184][T11671] usb 3-1: Product: syz [ 1088.950476][T11671] usb 3-1: Manufacturer: syz [ 1088.955708][T11671] usb 3-1: SerialNumber: syz [ 1088.998039][T13386] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1089.007373][T11671] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1089.016924][T13386] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.026408][T13386] usb 5-1: Product: syz [ 1089.032533][T13386] usb 5-1: Manufacturer: syz [ 1089.038390][T13386] usb 5-1: SerialNumber: syz [ 1089.087781][ T55] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1089.088116][T13386] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1089.103527][T23314] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1089.217776][T12487] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1089.437803][ T7] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1089.617809][ T55] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1089.628896][ T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.636950][ T55] usb 1-1: Product: syz [ 1089.647147][ T55] usb 1-1: Manufacturer: syz [ 1089.654750][ T55] usb 1-1: SerialNumber: syz [ 1089.661557][T11743] usb 4-1: USB disconnect, device number 106 [ 1089.697731][T11671] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1089.706743][T23314] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1089.707982][ T55] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1089.716673][T23314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.740438][T12487] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1089.741085][T23314] usb 6-1: Product: syz [ 1089.751200][T12487] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.756686][T23314] usb 6-1: Manufacturer: syz [ 1089.767296][T23314] usb 6-1: SerialNumber: syz [ 1089.774275][T12487] usb 2-1: Product: syz [ 1089.784566][T12487] usb 2-1: Manufacturer: syz [ 1089.787796][ T5] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1089.794333][T12487] usb 2-1: SerialNumber: syz [ 1089.808598][T23314] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1089.838227][T12487] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1089.900024][T13386] usb 3-1: USB disconnect, device number 6 [ 1089.991552][ T3704] usb 5-1: USB disconnect, device number 117 23:08:55 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1090.287705][ T55] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:55 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x0, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1090.407720][T12487] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:55 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1090.469042][T23314] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1090.510284][ T3670] usb 1-1: USB disconnect, device number 107 [ 1090.530509][ T7] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1090.539800][ T7] ath9k_htc: Failed to initialize the device [ 1090.552223][T11743] usb 4-1: ath9k_htc: USB layer deinitialized [ 1090.610894][ T9328] usb 2-1: USB disconnect, device number 105 [ 1090.767647][T11671] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1090.774582][T11671] ath9k_htc: Failed to initialize the device [ 1090.786693][T13386] usb 3-1: ath9k_htc: USB layer deinitialized [ 1090.847656][ T5] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1090.855839][ T5] ath9k_htc: Failed to initialize the device [ 1090.867361][ T3704] usb 5-1: ath9k_htc: USB layer deinitialized [ 1090.917585][T11743] usb 4-1: new high-speed USB device number 107 using dummy_hcd 23:08:56 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x0, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) 23:08:56 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1091.167663][T13386] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1091.247641][ T3704] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1091.327545][ T55] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1091.334468][ T55] ath9k_htc: Failed to initialize the device [ 1091.342320][ T3670] usb 1-1: ath9k_htc: USB layer deinitialized [ 1091.437537][T11743] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1091.447026][T11743] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.456881][T11743] usb 4-1: Product: syz [ 1091.463144][T11743] usb 4-1: Manufacturer: syz [ 1091.469955][T11743] usb 4-1: SerialNumber: syz [ 1091.487526][T12487] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1091.487612][T23314] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1091.494389][T12487] ath9k_htc: Failed to initialize the device [ 1091.507724][ T9328] usb 2-1: ath9k_htc: USB layer deinitialized [ 1091.508806][T11743] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1091.520772][T23314] ath9k_htc: Failed to initialize the device 23:08:56 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1091.692314][T15666] usb 6-1: USB disconnect, device number 95 [ 1091.698660][ T3670] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1091.715803][T15666] usb 6-1: ath9k_htc: USB layer deinitialized [ 1091.767515][T13386] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1091.776608][T13386] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.784796][T13386] usb 3-1: Product: syz [ 1091.790498][T13386] usb 3-1: Manufacturer: syz [ 1091.798156][T13386] usb 3-1: SerialNumber: syz [ 1091.828324][ T3704] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1091.837540][ T3704] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.845580][ T3704] usb 5-1: Product: syz [ 1091.850170][T13386] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1091.861475][ T3704] usb 5-1: Manufacturer: syz [ 1091.866667][ T3704] usb 5-1: SerialNumber: syz [ 1091.887502][ T9328] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1091.907780][ T3704] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1092.097480][T11743] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1092.167446][T15666] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1092.217787][ T3670] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1092.226873][ T3670] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.238875][ T3670] usb 1-1: Product: syz [ 1092.243529][ T3670] usb 1-1: Manufacturer: syz [ 1092.250662][ T3670] usb 1-1: SerialNumber: syz [ 1092.297790][ T3670] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1092.302605][T11671] usb 4-1: USB disconnect, device number 107 [ 1092.447514][ T9328] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1092.456666][ T9328] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.466357][ T9328] usb 2-1: Product: syz [ 1092.471757][ T9328] usb 2-1: Manufacturer: syz [ 1092.477187][ T9328] usb 2-1: SerialNumber: syz [ 1092.487454][T13386] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1092.527497][ T3704] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1092.536745][ T9328] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1092.687426][T15666] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1092.696584][T15666] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.698653][ T9328] usb 3-1: USB disconnect, device number 7 [ 1092.717925][T15666] usb 6-1: Product: syz [ 1092.722106][T15666] usb 6-1: Manufacturer: syz [ 1092.726684][T15666] usb 6-1: SerialNumber: syz [ 1092.734605][ T7] usb 5-1: USB disconnect, device number 118 23:08:58 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1092.777731][T15666] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1092.857432][ T3670] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1093.061991][T23314] usb 1-1: USB disconnect, device number 108 23:08:58 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x0, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1093.167357][T11743] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1093.174407][T11743] ath9k_htc: Failed to initialize the device [ 1093.186300][T11671] usb 4-1: ath9k_htc: USB layer deinitialized [ 1093.192506][ T5] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:08:58 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1093.337376][T15666] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1093.405205][ T55] usb 2-1: USB disconnect, device number 106 23:08:58 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x0, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1093.557290][T11671] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1093.567316][ T3704] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1093.574318][T13386] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1093.581517][T13386] ath9k_htc: Failed to initialize the device [ 1093.587530][ T3704] ath9k_htc: Failed to initialize the device [ 1093.593954][ T9328] usb 3-1: ath9k_htc: USB layer deinitialized [ 1093.600570][ T7] usb 5-1: ath9k_htc: USB layer deinitialized 23:08:59 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x0, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1093.887261][ T3670] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1093.894244][ T3670] ath9k_htc: Failed to initialize the device [ 1093.905962][T23314] usb 1-1: ath9k_htc: USB layer deinitialized [ 1093.987291][ T7] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1093.995006][ T9328] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 1094.147281][T11671] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1094.156437][T11671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.170044][T11671] usb 4-1: Product: syz [ 1094.174207][T11671] usb 4-1: Manufacturer: syz [ 1094.184417][T11671] usb 4-1: SerialNumber: syz [ 1094.238751][T11671] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1094.287298][ T5] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1094.294267][T23314] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1094.302122][ T5] ath9k_htc: Failed to initialize the device [ 1094.316625][ T55] usb 2-1: ath9k_htc: USB layer deinitialized [ 1094.367244][T15666] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1094.375657][T15666] ath9k_htc: Failed to initialize the device [ 1094.567558][ T7] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1094.576653][ T9328] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1094.585706][ T9328] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.594086][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.603697][ T9328] usb 3-1: Product: syz [ 1094.608246][ T7] usb 5-1: Product: syz [ 1094.612760][ T7] usb 5-1: Manufacturer: syz [ 1094.617665][ T9328] usb 3-1: Manufacturer: syz [ 1094.623008][ T9328] usb 3-1: SerialNumber: syz [ 1094.627960][ T7] usb 5-1: SerialNumber: syz [ 1094.667218][ T55] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1094.678847][ T9328] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1094.688483][ T7] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:09:00 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1094.740286][ T7] usb 6-1: USB disconnect, device number 96 [ 1094.764828][ T7] usb 6-1: ath9k_htc: USB layer deinitialized [ 1094.867276][T23314] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1094.876410][T23314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.886196][T23314] usb 1-1: Product: syz [ 1094.892606][T23314] usb 1-1: Manufacturer: syz [ 1094.898035][T23314] usb 1-1: SerialNumber: syz [ 1094.907203][T11671] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1094.938018][T23314] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1095.111393][T23314] usb 4-1: USB disconnect, device number 108 [ 1095.187196][ T55] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1095.196336][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1095.205847][ T55] usb 2-1: Product: syz [ 1095.207513][ T7] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 1095.210307][ T55] usb 2-1: Manufacturer: syz [ 1095.223026][ T55] usb 2-1: SerialNumber: syz [ 1095.267432][ T55] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1095.327163][ T9328] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1095.337566][T13386] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1095.529912][T11743] usb 3-1: USB disconnect, device number 8 [ 1095.532127][T11729] usb 5-1: USB disconnect, device number 119 23:09:00 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x0, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1095.587108][ T9028] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1095.792755][ T5] usb 1-1: USB disconnect, device number 109 [ 1095.799160][ T7] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1095.809116][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1095.825701][ T7] usb 6-1: Product: syz [ 1095.829922][ T7] usb 6-1: Manufacturer: syz [ 1095.835207][ T7] usb 6-1: SerialNumber: syz [ 1095.838547][ T55] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1095.897327][ T7] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1095.967053][T11671] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1095.973977][T11671] ath9k_htc: Failed to initialize the device [ 1095.986051][T23314] usb 4-1: ath9k_htc: USB layer deinitialized 23:09:01 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) 23:09:01 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x0, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1096.048738][T15666] usb 2-1: USB disconnect, device number 107 23:09:01 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x0, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1096.357182][T23314] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 1096.377034][ T9328] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1096.383956][T13386] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1096.390874][ T9328] ath9k_htc: Failed to initialize the device [ 1096.396947][T13386] ath9k_htc: Failed to initialize the device [ 1096.397011][T11743] usb 3-1: ath9k_htc: USB layer deinitialized [ 1096.409234][T11729] usb 5-1: ath9k_htc: USB layer deinitialized [ 1096.517020][ T7] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 23:09:01 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x0, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1096.608589][ T9028] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1096.615475][ T9028] ath9k_htc: Failed to initialize the device [ 1096.627996][ T5] usb 1-1: ath9k_htc: USB layer deinitialized [ 1096.766981][T11743] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 1096.786972][T11729] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1096.917084][T23314] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1096.926221][T23314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.927010][ T55] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1096.943974][ T55] ath9k_htc: Failed to initialize the device [ 1096.947249][T23314] usb 4-1: Product: syz [ 1096.950143][T15666] usb 2-1: ath9k_htc: USB layer deinitialized [ 1096.956308][T23314] usb 4-1: Manufacturer: syz [ 1096.973560][T23314] usb 4-1: SerialNumber: syz [ 1096.997010][ T5] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1097.027701][T23314] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1097.286947][T11743] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1097.296183][T11743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1097.310878][T11743] usb 3-1: Product: syz [ 1097.315040][T11743] usb 3-1: Manufacturer: syz [ 1097.325180][T15666] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1097.332994][T11743] usb 3-1: SerialNumber: syz [ 1097.379629][T11743] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1097.399037][T11729] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1097.409339][T11729] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1097.419131][T11729] usb 5-1: Product: syz [ 1097.424577][T11729] usb 5-1: Manufacturer: syz [ 1097.429575][T11729] usb 5-1: SerialNumber: syz [ 1097.489311][T11729] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1097.576987][ T7] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1097.583896][ T5] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1097.593440][ T7] ath9k_htc: Failed to initialize the device [ 1097.607474][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1097.615505][ T5] usb 1-1: Product: syz [ 1097.629906][ T5] usb 1-1: Manufacturer: syz [ 1097.634609][ T5] usb 1-1: SerialNumber: syz [ 1097.687035][T23314] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1097.696308][ T5] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested 23:09:03 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1097.765627][ T3670] usb 6-1: USB disconnect, device number 97 [ 1097.778161][ T3670] usb 6-1: ath9k_htc: USB layer deinitialized [ 1097.856886][T15666] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1097.866019][T15666] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1097.875000][T15666] usb 2-1: Product: syz [ 1097.879237][T15666] usb 2-1: Manufacturer: syz [ 1097.884811][T15666] usb 2-1: SerialNumber: syz [ 1097.896858][T12487] usb 4-1: USB disconnect, device number 109 [ 1097.937292][T15666] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1097.946894][T11743] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1098.156837][T11729] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1098.170059][T10944] usb 3-1: USB disconnect, device number 9 23:09:03 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1098.356866][ T5] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1098.361262][ T3670] usb 5-1: USB disconnect, device number 120 [ 1098.516803][T15666] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1098.559383][ T55] usb 1-1: USB disconnect, device number 110 23:09:03 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_genetlink_get_family_id$netlbl_unlabel(0x0) 23:09:03 executing program 2: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x0, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1098.720531][T11790] usb 2-1: USB disconnect, device number 108 [ 1098.766772][T23314] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1098.773806][T23314] ath9k_htc: Failed to initialize the device [ 1098.785694][T12487] usb 4-1: ath9k_htc: USB layer deinitialized 23:09:04 executing program 4: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0x0, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) [ 1099.006782][T11743] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1099.013801][T11743] ath9k_htc: Failed to initialize the device [ 1099.025101][T10944] usb 3-1: ath9k_htc: USB layer deinitialized 23:09:04 executing program 0: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'vlan0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, [], 0x1}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x64}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x6b50, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x0, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) select(0x40, &(0x7f0000000740)={0x11f1, 0x7ff, 0x1, 0x9, 0x7ff, 0x3, 0x8001, 0x9}, &(0x7f0000000780)={0x10001, 0x0, 0x1, 0x1, 0x7fffffff, 0xffffffff, 0x5, 0x1}, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2, 0x0, 0x7, 0x8000, 0x4}, &(0x7f0000000800)={0x77359400}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$RAW_CHAR_CTRL_SETBIND(0xffffffffffffffff, 0xac00, &(0x7f0000000900)={0x1, 0x7, 0x0}) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x7c, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private0}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) [ 1099.086765][ C0] ================================================================== [ 1099.094876][ C0] BUG: KCSAN: data-race in wg_packet_send_staged_packets / wg_packet_send_staged_packets [ 1099.104740][ C0] [ 1099.107044][ C0] write to 0xffff88812a869a08 of 4 bytes by interrupt on cpu 1: [ 1099.114694][ C0] wg_packet_send_staged_packets+0x5d5/0x990 [ 1099.120655][ C0] wg_packet_send_keepalive+0xea/0x100 [ 1099.126094][ C0] wg_expired_send_persistent_keepalive+0x38/0x50 [ 1099.132488][ C0] call_timer_fn+0x2e/0x240 [ 1099.136750][T12487] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1099.136967][ C0] expire_timers+0x116/0x260 [ 1099.136984][ C0] __run_timers+0x338/0x3d0 [ 1099.155701][ C0] run_timer_softirq+0x19/0x30 [ 1099.160772][ C0] __do_softirq+0x13c/0x2c3 [ 1099.165563][ C0] asm_call_irq_on_stack+0xf/0x20 [ 1099.170690][ C0] do_softirq_own_stack+0x32/0x40 [ 1099.175722][ C0] __irq_exit_rcu+0xb4/0xc0 [ 1099.181130][ C0] sysvec_apic_timer_interrupt+0x74/0x90 [ 1099.187705][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1099.194338][ C0] kcsan_setup_watchpoint+0x1fc/0x4e0 [ 1099.199712][ C0] tomoyo_domain_quota_is_ok+0xd7/0x2d0 [ 1099.206287][ C0] tomoyo_supervisor+0x1f4/0xb20 [ 1099.212612][ C0] tomoyo_path_perm+0x261/0x330 [ 1099.217809][ C0] tomoyo_path_symlink+0x49/0x70 [ 1099.223963][ C0] security_path_symlink+0x95/0xf0 [ 1099.229076][ C0] do_symlinkat+0xa7/0x280 [ 1099.233489][ C0] __x64_sys_symlink+0x32/0x40 [ 1099.238229][ C0] do_syscall_64+0x39/0x80 [ 1099.242624][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1099.248499][ C0] [ 1099.250801][ C0] read to 0xffff88812a869a08 of 4 bytes by interrupt on cpu 0: [ 1099.258321][ C0] wg_packet_send_staged_packets+0x592/0x990 [ 1099.264293][ C0] wg_packet_send_keepalive+0xea/0x100 [ 1099.269857][ C0] wg_expired_send_persistent_keepalive+0x38/0x50 [ 1099.276253][ C0] call_timer_fn+0x2e/0x240 [ 1099.280737][ C0] expire_timers+0x116/0x260 [ 1099.285326][ C0] __run_timers+0x338/0x3d0 [ 1099.289810][ C0] run_timer_softirq+0x19/0x30 [ 1099.294557][ C0] __do_softirq+0x13c/0x2c3 [ 1099.299044][ C0] asm_call_irq_on_stack+0xf/0x20 [ 1099.304048][ C0] do_softirq_own_stack+0x32/0x40 [ 1099.309070][ C0] __irq_exit_rcu+0xb4/0xc0 [ 1099.313600][ C0] sysvec_apic_timer_interrupt+0x74/0x90 [ 1099.319215][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1099.325170][ C0] __sanitizer_cov_trace_pc+0xd/0x60 [ 1099.330432][ C0] tomoyo_check_acl+0x102/0x200 [ 1099.335258][ C0] tomoyo_path_perm+0x22f/0x330 [ 1099.340086][ C0] tomoyo_inode_getattr+0x18/0x20 [ 1099.345125][ C0] security_inode_getattr+0x7f/0xd0 [ 1099.350314][ C0] vfs_statx+0xf8/0x270 [ 1099.354458][ C0] __se_sys_newlstat+0x46/0x250 [ 1099.359284][ C0] __x64_sys_newlstat+0x2d/0x40 [ 1099.364111][ C0] do_syscall_64+0x39/0x80 [ 1099.368505][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1099.374402][ C0] [ 1099.376717][ C0] Reported by Kernel Concurrency Sanitizer on: [ 1099.382838][ C0] CPU: 0 PID: 4892 Comm: systemd-udevd Not tainted 5.11.0-rc1-syzkaller #0 [ 1099.386724][T10944] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1099.391405][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1099.391416][ C0] ================================================================== [ 1099.391423][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 1099.391433][ C0] CPU: 0 PID: 4892 Comm: systemd-udevd Not tainted 5.11.0-rc1-syzkaller #0 [ 1099.433618][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1099.445117][ C0] Call Trace: [ 1099.448439][ C0] [ 1099.451549][ C0] dump_stack+0x116/0x15d [ 1099.456491][ C0] panic+0x1e7/0x5fa [ 1099.461317][ C0] ? vprintk_emit+0x2e2/0x360 [ 1099.466117][ C0] kcsan_report+0x67b/0x680 [ 1099.471112][ C0] ? kcsan_setup_watchpoint+0x47b/0x4e0 [ 1099.476657][ C0] ? wg_packet_send_staged_packets+0x592/0x990 [ 1099.483105][ C0] ? wg_packet_send_keepalive+0xea/0x100 [ 1099.488949][ C0] ? wg_expired_send_persistent_keepalive+0x38/0x50 [ 1099.496252][ C0] ? call_timer_fn+0x2e/0x240 [ 1099.501803][ C0] ? expire_timers+0x116/0x260 [ 1099.507016][ C0] ? __run_timers+0x338/0x3d0 [ 1099.512643][ C0] ? run_timer_softirq+0x19/0x30 [ 1099.517582][ C0] ? __do_softirq+0x13c/0x2c3 [ 1099.522495][ C0] ? asm_call_irq_on_stack+0xf/0x20 [ 1099.527697][ C0] ? do_softirq_own_stack+0x32/0x40 [ 1099.532895][ C0] ? __irq_exit_rcu+0xb4/0xc0 [ 1099.538964][ C0] ? sysvec_apic_timer_interrupt+0x74/0x90 [ 1099.544764][ C0] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1099.550913][ C0] ? __sanitizer_cov_trace_pc+0xd/0x60 [ 1099.556513][ C0] ? tomoyo_check_acl+0x102/0x200 [ 1099.561540][ C0] ? tomoyo_path_perm+0x22f/0x330 [ 1099.566753][ C0] ? tomoyo_inode_getattr+0x18/0x20 [ 1099.566914][T15666] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1099.571949][ C0] ? security_inode_getattr+0x7f/0xd0 [ 1099.571972][ C0] ? vfs_statx+0xf8/0x270 23:09:04 executing program 5: openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000}}}, 0xa0) select(0x0, 0x0, 0x0, &(0x7f00000007c0)={0x3, 0x6, 0x5, 0x2}, &(0x7f0000000800)={0x77359400}) syz_genetlink_get_family_id$netlbl_unlabel(0x0) [ 1099.586477][T15666] ath9k_htc: Failed to initialize the device [ 1099.588924][ C0] ? __se_sys_newlstat+0x46/0x250 [ 1099.588949][ C0] ? __x64_sys_newlstat+0x2d/0x40 [ 1099.588970][ C0] ? do_syscall_64+0x39/0x80 [ 1099.599993][T11790] usb 2-1: ath9k_htc: USB layer deinitialized [ 1099.604954][ C0] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1099.604988][ C0] kcsan_setup_watchpoint+0x47b/0x4e0 [ 1099.627921][ C0] ? ktime_get_coarse_with_offset+0x12e/0x160 [ 1099.634600][ C0] wg_packet_send_staged_packets+0x592/0x990 [ 1099.641675][ C0] wg_packet_send_keepalive+0xea/0x100 [ 1099.647151][ C0] ? wg_expired_zero_key_material+0x100/0x100 [ 1099.654123][ C0] wg_expired_send_persistent_keepalive+0x38/0x50 [ 1099.661154][ C0] call_timer_fn+0x2e/0x240 [ 1099.665864][ C0] ? wg_expired_zero_key_material+0x100/0x100 [ 1099.672375][ C0] expire_timers+0x116/0x260 [ 1099.677048][ C0] __run_timers+0x338/0x3d0 [ 1099.682551][ C0] ? kvm_sched_clock_read+0x15/0x40 [ 1099.688897][ C0] ? sched_clock+0xf/0x20 [ 1099.694261][ C0] run_timer_softirq+0x19/0x30 [ 1099.699664][ C0] __do_softirq+0x13c/0x2c3 [ 1099.705054][ C0] asm_call_irq_on_stack+0xf/0x20 [ 1099.711102][ C0] [ 1099.714335][ C0] do_softirq_own_stack+0x32/0x40 [ 1099.720250][ C0] __irq_exit_rcu+0xb4/0xc0 [ 1099.725331][ C0] sysvec_apic_timer_interrupt+0x74/0x90 [ 1099.731657][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1099.737020][T12487] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1099.737643][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 [ 1099.752076][T12487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1099.752682][ C0] Code: 00 5b c3 66 2e 0f 1f 84 00 00 00 00 00 e9 eb 97 10 00 cc cc cc cc cc cc cc cc cc cc cc 48 8b 04 24 65 48 8b 0c 25 00 6d 01 00 <65> 8b 15 f8 b7 bb 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 [ 1099.769655][T12487] usb 4-1: Product: syz [ 1099.780247][ C0] RSP: 0018:ffffc90000d7fb40 EFLAGS: 00000246 [ 1099.780265][ C0] RAX: ffffffff826cf6b2 RBX: ffffc90000d7fbd0 RCX: ffff888102793000 [ 1099.780275][ C0] RDX: 0001c90000d7fbf0 RSI: 00000000073ea459 RDI: ffffc90000d7fbf0 [ 1099.780284][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0001c90000d7fbf7 [ 1099.780293][ C0] R10: 0001ffffffffffff R11: ffff888102793000 R12: ffff88810ad72400 [ 1099.780302][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888107a85e10 [ 1099.780315][ C0] ? tomoyo_check_acl+0x102/0x200 [ 1099.795537][T12487] usb 4-1: Manufacturer: syz [ 1099.799564][ C0] tomoyo_check_acl+0x102/0x200 [ 1099.799589][ C0] ? tomoyo_execute_permission+0x190/0x190 [ 1099.799608][ C0] tomoyo_path_perm+0x22f/0x330 [ 1099.822496][T12487] usb 4-1: SerialNumber: syz [ 1099.824281][ C0] tomoyo_inode_getattr+0x18/0x20 [ 1099.870430][ C0] security_inode_getattr+0x7f/0xd0 [ 1099.876937][ C0] vfs_statx+0xf8/0x270 [ 1099.877756][T12487] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1099.881099][ C0] __se_sys_newlstat+0x46/0x250 [ 1099.881129][ C0] ? __secure_computing+0x12e/0x1c0 [ 1099.900205][ C0] ? syscall_trace_enter+0x153/0x2b0 [ 1099.906424][ C0] __x64_sys_newlstat+0x2d/0x40 [ 1099.911756][ C0] do_syscall_64+0x39/0x80 [ 1099.916177][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1099.923208][ C0] RIP: 0033:0x7f45ba53a335 23:09:05 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x519140, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card1/oss_mixer\x00', 0x400, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcc3b}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}]}, 0x58}}, 0x240008c1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm_plock\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0xa, 0xfffffffb, 0x8, 0xf267, 0x330, 0xffffffffffffffff, 0x8, [], 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x40) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r2, r3}, 0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000440)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000004c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000400), 0x1, r4, 0x10, 0x1, @ib={0x1b, 0x2, 0x0, {"08df7cc7c7c8fa76c9ae46e2a34ff05e"}, 0xe000000000000000, 0x0, 0x200}}}, 0xa0) perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x5, 0x0, 0x80, 0x5, 0x0, 0x39b, 0x210, 0xa, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000580), 0x8}, 0x54e04, 0xb615, 0x3, 0x9, 0x8001, 0x5, 0x1ff}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) select(0x40, &(0x7f0000000640)={0x10000, 0xa159, 0x7, 0x2, 0x7, 0x800, 0x9, 0x1c341e06}, &(0x7f0000000680)={0x80, 0x1f, 0x2, 0x2, 0x0, 0x8, 0x80000001, 0xff}, &(0x7f00000006c0)={0x1, 0xffffffff00000001, 0x6, 0x7, 0x7ff, 0x6, 0x0, 0x9}, &(0x7f0000000700)) prctl$PR_GET_DUMPABLE(0x3) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) [ 1099.928119][ C0] Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89 [ 1099.947806][ C0] RSP: 002b:00007ffdc4b7d2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000006 [ 1099.956573][ C0] RAX: ffffffffffffffda RBX: 0000557ea397c6d0 RCX: 00007f45ba53a335 [ 1099.965843][ C0] RDX: 00007ffdc4b7d310 RSI: 00007ffdc4b7d310 RDI: 0000557ea397b6d0 [ 1099.975138][ C0] RBP: 00007ffdc4b7d3d0 R08: 00007f45ba7f91c8 R09: 0000000000001010 [ 1099.983886][ C0] R10: 00000000000000d0 R11: 0000000000000246 R12: 0000557ea397b6d0 [ 1099.992284][ C0] R13: 0000557ea397b6f0 R14: 0000557ea3981ddb R15: 0000557ea3981de0 [ 1100.001245][ C0] Kernel Offset: disabled [ 1100.005560][ C0] Rebooting in 86400 seconds..