last executing test programs: 8.195991545s ago: executing program 4 (id=2117): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000080), 0x12) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') r2 = syz_open_dev$video(&(0x7f0000000040), 0x3, 0x101002) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x2f, 0x2, 0x9e, 0x2, 0x25, @mcast2, @empty, 0x8, 0x700, 0x4, 0x401}}) r8 = socket(0x10, 0x803, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000003b00)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd2d, 0x2, {0x0, 0x0, 0x0, r10, {0x0, 0x6}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x10e4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0xac, r5, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x54, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$sock_int(r12, 0x1, 0x1d, 0x0, &(0x7f0000000280)=0x45) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000013000500000000000000000007000000", @ANYRES32=r11, @ANYBLOB="000000000000000014001a80100004800c000a80"], 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x44048010) ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f0000000340)={0xa, @pix={0x0, 0x0, 0x34343459, 0x3, 0x0, 0x0, 0x3, 0xfeedcafe, 0x3, 0x0, 0x8002, 0x4}}) 7.831955834s ago: executing program 4 (id=2120): r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000300)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r5, 0x0, 0x0}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000600)={'ip6_vti0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x0, 0xf7, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x700, 0x8000, 0x3, 0x3}}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r9, 0x6, 0x1e, 0x0, &(0x7f0000002000)) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x100}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pipe2$watch_queue(&(0x7f0000000100), 0x80) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001900)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r12, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) 7.578939255s ago: executing program 3 (id=2122): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000040)={0x12, 0x10, 0xfa00, {0xffffffffffffffff, r1, r0}}, 0x18) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x28040600) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x100000000) 7.418593461s ago: executing program 3 (id=2123): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000040), 0x2, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x200, 0x1, &(0x7f0000000440)=[r2], &(0x7f0000000200), &(0x7f0000000300)=[r3], &(0x7f0000000340)}) (fail_nth: 6) 6.644004047s ago: executing program 3 (id=2124): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b"], 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff0000000015040000000002000f030000000000003404000001ed0a0014040000170000801c130000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = openat$cgroup_root(0xffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x85, 0x0, &(0x7f00000000c0)) connect$vsock_stream(r3, &(0x7f0000000000), 0x10) io_setup(0xb, &(0x7f0000000240)=0x0) io_getevents(r5, 0x1fffe, 0x0, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) setsockopt$sock_int(r4, 0x1, 0x12, 0x0, 0x0) openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.bfq.time_recursive\x00', 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000000)) 6.451215934s ago: executing program 4 (id=2125): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f0000000080)={0xa, @pix_mp={0x7baec3f0, 0x1, 0x32314d59, 0x5, 0x5, [{0x9ab, 0x1}, {0xffffff8c, 0xff}, {0x200, 0x5}, {0x800, 0x9}, {0xce06, 0xa61}, {0x4}, {0x80000000, 0x6}, {0x4, 0x8}], 0x7, 0xc, 0x6, 0x2, 0x4}}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000000)=0x5) recvmmsg(r4, &(0x7f0000000740)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000480)=""/9, 0x9}], 0x1}, 0x8}], 0x2, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) socket$inet6(0xa, 0x3, 0x87) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) shutdown(r6, 0x1) ppoll(&(0x7f0000000000)=[{r6, 0x4}], 0x1, 0x0, 0x0, 0x0) 5.963258191s ago: executing program 1 (id=2127): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="aa000000", @ANYRES16=r0, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32=r2, @ANYBLOB="080026009409000008002600850900000800270000000000050018010e0000000800a000050000000500190105000000080027000100000008002600a4150000080026001b1700000800b7"], 0xb0}}, 0x0) (fail_nth: 7) 5.58894043s ago: executing program 4 (id=2128): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0xffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x44, 0xb, 0x6, 0x201, 0x0, 0x0, {0x6, 0x0, 0x42}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x44000801}, 0x4800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)=0x7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002200)={{{@in=@local, @in=@dev}}, {{@in6=@private1}, 0x0, @in6=@local}}, &(0x7f0000002440)=0xe4) sendmsg$netlink(r0, &(0x7f0000002400)={&(0x7f0000002180)=@kern={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002380)=[{&(0x7f0000002300)={0x3c, 0x1c, 0x2, 0x70bd2a, 0x25dfdc01, "", [@typed={0xf, 0x116, 0x0, 0x0, @binary="5537ff987421d44e221903"}, @typed={0xc, 0x12e, 0x0, 0x0, @u64=0x2005}, @typed={0x8, 0x1e, 0x0, 0x0, @u32=0x6}, @typed={0x8, 0xf8, 0x0, 0x0, @u32=0x1ef06b92}]}, 0x3c}], 0x1, &(0x7f0000002480)=ANY=[@ANYBLOB="1c000000010000000100000010168332167f691d8a51d67cf853e07a76663446f6af7a54e677bf2893659264c710b6149770a89a0104abdb8d502f085672ffc0e334f25bc854c52f9d3221fbdbe93536fc81ccd8846bdf46a157e764b893149334f32b8553c2288039de26af7e1c751fe0a1df9474cee0d837efee4d5b6f5f8130ac4d5aab56e9370034238c4a9b263a59c27a69582f47", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32], 0x1c, 0x40084}, 0x4000001) r3 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000180)=""/9, 0x9}], 0x1, 0x2f, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x5a101) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101282, 0x0) r8 = dup(r7) read$FUSE(r8, &(0x7f0000000140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f00000000c0)={0x50, 0xe5dd5574dbe1c0bb, r9, {0x7, 0x29, 0x6, 0x10240, 0x6, 0x5, 0xb, 0x2, 0x0, 0x0, 0x8, 0x100}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x58, r6, 0x1, 0x0, 0xfffffffe, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME={0x3c, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x6}, @broadcast, @device_a, @initial, {0x6}, @value=@ver_80211n={0x0, 0x6, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}}, 0x32, @val={0x8c, 0x18, {0x77, "245271fd63c1", @long="778789bfa5ce70db359d885eaa2e95a6"}}}}]}, 0x58}}, 0x8000) syz_usb_connect(0x3, 0x34, &(0x7f00000021c0)=ANY=[@ANYBLOB="12011001b1fb66101e090300bb35010203010902220001080540040904ce01016fda0dd8000705f71f22810b09050c0200020103"], 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0xccc43) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x54, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x888e}, @NL80211_ATTR_FRAME={0x22, 0x33, @data_frame={@msdu=@type11={{}, {}, @device_a, @device_a, @broadcast, {}, @device_b}, @a_msdu}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 5.473216191s ago: executing program 2 (id=2129): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0xffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x44, 0xb, 0x6, 0x201, 0x0, 0x0, {0x6, 0x0, 0x42}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x44000801}, 0x4800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)=0x7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002200)={{{@in=@local, @in=@dev}}, {{@in6=@private1}, 0x0, @in6=@local}}, &(0x7f0000002440)=0xe4) sendmsg$netlink(r0, &(0x7f0000002400)={&(0x7f0000002180)=@kern={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002380)=[{&(0x7f0000002300)={0x3c, 0x1c, 0x2, 0x70bd2a, 0x25dfdc01, "", [@typed={0xf, 0x116, 0x0, 0x0, @binary="5537ff987421d44e221903"}, @typed={0xc, 0x12e, 0x0, 0x0, @u64=0x2005}, @typed={0x8, 0x1e, 0x0, 0x0, @u32=0x6}, @typed={0x8, 0xf8, 0x0, 0x0, @u32=0x1ef06b92}]}, 0x3c}], 0x1, &(0x7f0000002480)=ANY=[@ANYBLOB="1c000000010000000100000010168332167f691d8a51d67cf853e07a76663446f6af7a54e677bf2893659264c710b6149770a89a0104abdb8d502f085672ffc0e334f25bc854c52f9d3221fbdbe93536fc81ccd8846bdf46a157e764b893149334f32b8553c2288039de26af7e1c751fe0a1df9474cee0d837efee4d5b6f5f8130ac4d5aab56e9370034238c4a9b263a59c27a69582f47", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32], 0x1c, 0x40084}, 0x4000001) r3 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000180)=""/9, 0x9}], 0x1, 0x2f, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x5a101) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101282, 0x0) r8 = dup(r7) read$FUSE(r8, &(0x7f0000000140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f00000000c0)={0x50, 0xe5dd5574dbe1c0bb, r9, {0x7, 0x29, 0x6, 0x10240, 0x6, 0x5, 0xb, 0x2, 0x0, 0x0, 0x8, 0x100}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x58, r6, 0x1, 0x0, 0xfffffffe, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME={0x3c, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x6}, @broadcast, @device_a, @initial, {0x6}, @value=@ver_80211n={0x0, 0x6, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}}, 0x32, @val={0x8c, 0x18, {0x77, "245271fd63c1", @long="778789bfa5ce70db359d885eaa2e95a6"}}}}]}, 0x58}}, 0x8000) syz_usb_connect(0x3, 0x34, &(0x7f00000021c0)=ANY=[@ANYBLOB="12011001b1fb66101e090300bb35010203010902220001080540040904ce01016fda0dd8000705f71f22810b09050c0200020103"], 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0xccc43) io_setup(0x3, &(0x7f0000000180)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x54, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x888e}, @NL80211_ATTR_FRAME={0x22, 0x33, @data_frame={@msdu=@type11={{}, {}, @device_a, @device_a, @broadcast, {}, @device_b}, @a_msdu}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 5.443886777s ago: executing program 0 (id=2130): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r1, 0xc01064ab, &(0x7f0000000180)={0xb1}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/vlan/vlan0\x00') r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r5 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d412", 0x21) writev(r5, &(0x7f0000000140)=[{&(0x7f0000000780)="aefdda9d240302005a90f57fe782ffb1de75ed543aeff0f64eb92c220a2e11b44ecb010852f426072a00000000931b9cb5e3f6809349d13ac57cee60896283a396eef4e52bb85192f2e14edec72df259730fdd51c0584fb41df2b2b55c79671a706cb9e282469ae5084275a3cafd95c56a8123a72c5f8e9416b6a36320a323dfc2b1cc70cd82a08c357f445c6b0cccf918c3a433d3128a7aa93420078f1f74900ba4ffc0c239659ce7df", 0xaa}], 0x1) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(0xffffffffffffffff, 0xc01064c7, &(0x7f0000000200)={0x9, 0x0, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000040)={'vlan0\x00', 0x40}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1800006, 0x80010, r2, 0x6e838000) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r6, 0x80049370, &(0x7f0000000340)) sendmsg$tipc(r8, &(0x7f0000000140)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000800)=[{&(0x7f00000018c0)="09e438", 0xff8a}], 0x1}, 0x2000c015) recvmmsg(r8, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)=""/130, 0x82}], 0x1, &(0x7f0000000600)=""/212, 0xd4}}], 0x1, 0x0, 0x0) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffc, @remote, 0x1}, 0x20) connect$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x2}, 0x20) 5.087002545s ago: executing program 1 (id=2131): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'wg0\x00', 0x0}) r3 = syz_open_dev$vcsn(0x0, 0x3f0b, 0x117001) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b000000005cc96b5600000008000400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESHEX, @ANYRES64=r2], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, &(0x7f0000000200)=[0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0], 0x0, 0x54, &(0x7f0000000280)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000002c0), &(0x7f0000000380), 0x8, 0xa7, 0x8, 0x0, 0x0}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000880)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0xd, 0x1b, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000060000000000ebbaa0f18100100200000018000000d90600000000000000ffffffb7080000000000007b8af8ff00000000b7080000100000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa40000b70200000800000018230000000a0000000000070aa2bbda1e", @ANYBLOB="0000000000000000b70500000800000085000000a5000000852000000100000085100000b1fbbb0b180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000210200008500000006000000"], &(0x7f00000000c0)='syzkaller\x00', 0x1, 0x60, &(0x7f0000000740)=""/96, 0x41100, 0x1c, '\x00', r2, @sock_ops=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x1, 0xf, 0x2, 0x6}, 0x10, r4, 0xffffffffffffffff, 0x1, &(0x7f00000008c0), &(0x7f0000000900)=[{0x2, 0x3, 0x6, 0xa}], 0x10, 0x0, @void, @value}, 0x94) r5 = epoll_create1(0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f00000000c0)={0xe000001a}) preadv(r6, &(0x7f0000000640)=[{&(0x7f0000000100)=""/115, 0x73}], 0x1, 0x80000001, 0x800000f5) r7 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000540), 0x20a800, 0x0) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0xffffffffffffffff, 0x150, 0x8}, 0xc) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000640)=@generic={&(0x7f00000005c0)='./file0\x00', 0x0, 0x18}, 0x14) r10 = bpf$ITER_CREATE(0x21, &(0x7f0000000680), 0x8) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0xffffffffffffffff, 0x1ff, 0x18}, 0xc) r12 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_misc(r13, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r12, 0x4c0a, &(0x7f00000002c0)={r13, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1d, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd0007008019000000000000000000000000af1e4ccfb7b3cad800", [0x0, 0x2000000000001]}}) sendmsg$RDMA_NLDEV_CMD_DELLINK(r13, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x1404, 0x300, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r14 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r15 = dup(r14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r15, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0x17, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@tail_call, @jmp={0x5, 0x1, 0xc, 0x7, 0x7, 0xc, 0x4}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x22}, @tail_call, @alu={0x4, 0x0, 0x0, 0x3, 0xb, 0x2, 0xfffffffffffffffc}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x3}, @ldst={0x0, 0x2, 0x3, 0x4, 0x9, 0x2, 0x1}, @ldst={0x0, 0x3, 0x0, 0x5, 0x8, 0xfffffffffffffffe, 0x1}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}]}, &(0x7f0000000100)='syzkaller\x00', 0x5, 0x82, &(0x7f0000000140)=""/130, 0x41100, 0x25, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000500)={0x3, 0x5}, 0x10, r4, r6, 0x3, &(0x7f0000000700)=[0xffffffffffffffff, r7, r8, r9, r10, r11, r13, 0x1, r15], &(0x7f0000000740)=[{0x5, 0x2, 0x0, 0x5}, {0x3, 0x4, 0xc, 0x1}, {0x3, 0x3, 0x80000000, 0x6}], 0x10, 0x0, @void, @value}, 0x94) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 4.991886442s ago: executing program 0 (id=2132): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x2}, 0x18) 4.836988392s ago: executing program 1 (id=2133): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000040)={0x12, 0x10, 0xfa00, {0xffffffffffffffff, r1, r0}}, 0x18) unshare(0x28040600) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x100000000) 4.671100469s ago: executing program 1 (id=2134): r0 = openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x8, r1, 0x0, 0x9, 0x26, &(0x7f00000000c0)="93ee211327777ef927565bce31ec34ad1b2f0f0dd37ed29025d1e3dfeed518ad9a6d33ee363a", 0x2}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @local}, 0x2, 0x2, 0x3, 0x3}}, 0x2e) r2 = openat$loop_ctrl(0xffffff9c, &(0x7f00000001c0), 0x20000, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r4 = openat$vcsa(0xffffff9c, &(0x7f0000000200), 0x40000, 0x0) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e24, 0x92, @dev={0xfe, 0x80, '\x00', 0x2d}, 0x4}, 0x1c) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000280)={0x0, 0x6, 0x2, 0x1}) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) socket$kcm(0x29, 0x5, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000680)={r4, 0x3, {0x0, 0x0, 0x0, 0x1c861d4b, 0x9, 0x0, 0xa, 0xe, 0x2, "ef116d831cdf3a017cd0b1b16b860361203a02ad0ba34dc77660b59abed421692dbf0e84062b238282a4a2e02a2ed4dee64dfcd1b86bc6d56f06fdd5b29e722a", "6102c5c7264d30331d4eabab21e1b85d1316f74106808503cfa7070df9bee347ab6ac57bd046b8c8cb75ae225e8ffbffdec7f7048fefa6ec08c26a405560adda", "c6744a1377d3b4cd6f3ffd67196f297caad10e3d652537fb88b69b527850ce48", [0xffffffffffffffff, 0xffffffffffffff3c]}}) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r3) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f00000007c0)="7d235bc9d84a3d7ab81b6bb5f8de6b396b52ae851fa2dfbc9f861a85e394ec2bc5eab81ad4a4c90a77010c55c0ae68b5f6391fc89a0299141e3bf705a7638ab644e73a88a98ebf84b520ddc2d6bc85c0a58bf7a3242ebe3510c1e8e64598f8871c98c57f47458e00a971d569a51158351ac78dae08c65d95521b1f4b4673640f1a19115458bdf25b146e445b94cda5d3783c868e004aa45c368f93d64d7a9833caa1c235808372153e7aa7ff06af91dc1d072526381cee9c3caf325b1f0d6946f5ba741deb2e696bc1c9034ed204bd64115298cc6e4083a401df54608723d7d084b6faf8d928ffec68471d9a48d0eda8f6841003ee4809091701a806bfc16f3e") r5 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000008c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x172f, 0x38, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xc, 0xa0, 0xf7, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x2, 0x3, {0x9, 0x21, 0x2, 0x2, 0x1, {0x22, 0x289}}, {{{0x9, 0x5, 0x81, 0x3, 0x6648e0af3a61708c, 0x2, 0x81, 0xc}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x5, 0x8, 0xf}}]}}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000900)={0xa, 0x6, 0x201, 0x0, 0x87, 0x4, 0x8, 0xb7}, 0x15a, &(0x7f0000000940)={0x5, 0xf, 0x15a, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "f2d826c960a405f5bae15bd22eda8d77"}, @generic={0xfa, 0x10, 0xb, "a33984e5fa923817a6491c76e2b355b69cf5e652f97e269e1c6e66afc3af46032a04aefb67941c95b3cb6265bd54f946a5311393486a2e7da4f562d8faf3d8f9b0030a6a71ff16cfec1a47212abca817a3166bacd4f8e113eb7ade64fd093b9922c79a5214213fed309a57f56a400f7cfe98ad49e7aa99dff9611dcc7a1d7193cc810a14b8d2053a129d3ab1f88bc8330dceecdd72faae2a5737a36ad40a6ea41d2a75098e38f0ae35ff99f8067e6e367c0be71423a676bcdf13b8883ffb24710d019b29e958f3b1d82d3e2950329e2d9792b5c0dfc1a0f23b5b1047bcf41773900989f66c6758d450051d0ec1f08222dca6d16fe9a3f6"}, @ssp_cap={0x18, 0x10, 0xa, 0x4, 0x3, 0x5, 0x8800, 0x8000, [0xffd8, 0xffa0, 0xc03f]}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x9, 0xff0f, 0x7ff, [0xa000]}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "9ac91054e4379785507b9df83cf37020"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0x5, 0x4, 0x8, 0x8}]}, 0x4, [{0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x439}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x3c01}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f0000000b80)=@string={0x4, 0x3, "c057"}}]}) syz_usb_control_io$hid(r5, &(0x7f0000000dc0)={0x14, &(0x7f0000000c00)={0x60, 0x4, 0xe0, {0xe0, 0x8, "616bb24a30f3923fbcb407b2c3dbcee6d307f2443b30449032134f635f19c5352eb40c84ca68bd0f876c5ac5babf5d406187ed2524181c1f5ef4d05272665da6ad9ae647334e2dc85abcb1f2ec55a7d61ae6a549c35ec8f95dbcd6307861cc330afceb84d84227728fb69181a58f0690518617afd3a9d7b07c604852f785c6e25ffeec7ed78c9fdff9c9edf7fd6049e696ec8ddcbe7c37b2a96d619a698976f6b60b10f81398b48a5730d2ce47ac0d528bdbd98d537de4e06cfb157df29e103c9ae458192ffee0b989ffb7636a622519f51e3ce3d1b9d13c12f385b64db4"}}, &(0x7f0000000d00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xf50297aa70150768}}, &(0x7f0000000d40)={0x0, 0x22, 0x8, {[@global=@item_012={0x0, 0x1, 0x2}, @local=@item_012={0x1, 0x2, 0x0, 'X'}, @main=@item_4={0x3, 0x0, 0xa, "ac7a099c"}]}}, &(0x7f0000000d80)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0xe, 0x1, {0x22, 0xa2e}}}}, &(0x7f0000001040)={0x18, &(0x7f0000000e00)={0x20, 0x17, 0x79, "d444ba3afd996b23b36536d4f61f372f61713a2df92a635b247317cb4e502d9d8cb4631c03e5047891292f3f4a9c2f2ac0f6d3f822b95f0523a4f41b0aeff50f6ea3af431afb0d750b1b5d322c73096717951d23e98f7e78b81c8fe87981f04f7020d9f1f356a894d7c0a161d6488e0127baecc958d40ff982"}, &(0x7f0000000e80)={0x0, 0xa, 0x1}, &(0x7f0000000ec0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000f00)={0x20, 0x1, 0xef, "edcfc39b37b94d708ac0d6ff42229672733f3e71f40951516fb0daf9414ea4e1fc021b511f0be1aea487aa8fb010fd652fce55ffba3aa2afd78e46bc9972944fdf6d720b19d87b664b43b83d27a6ae13dcca1dec808f14c5f904bd9ef52c6d90e8841f8219e82950ad6dbeacddebf83a6648ef6a0557f5c53f63a12aac74d1c6bb04c9514bbdf49a76fd10e7ace4150cddcff3944e06abb46fa6c6e8dac2b4fb37c6a253574cc8935c7f9e5ca20b22965e2f90aafde65f1d53358fac296b23e1f28bc722fd34313fb334e256695f6d8ed1518ce739f7d3d0d5a5a49044553938165cf17066a615678c4038e5c4a91a"}, &(0x7f0000001000)={0x20, 0x3, 0x1, 0x4}}) getsockopt$XDP_MMAP_OFFSETS(r4, 0x11b, 0x1, &(0x7f0000001080), &(0x7f0000001100)=0x80) r6 = openat$audio1(0xffffff9c, &(0x7f0000001140), 0x7c000, 0x0) fcntl$addseals(r6, 0x409, 0x0) r7 = syz_clone(0x50001000, &(0x7f0000001180)="8c96f81ee68938b41d34dc1dc6d5247d1c11ec131ad69ae90ff6ed5b212f56f9c50ee291a9da71b8b4721e0ba1251f03db3218283066f7be6340555a60803e0ea6e8", 0x42, &(0x7f0000001200), &(0x7f0000001240), &(0x7f0000001280)="967c7595af63c18536f2beb2fb97d1f5442044a0840a63bf8f003f2fc4dc692a2092fefa19773a1853d35927ffd15564255734328ff20a6df2548523b5dec822c5a6550e01225a42cd082e8f41630875f9ee317bc28d13d3c5a547ac1e6858450a039ecff39f79ac50e2ab429d0433c9caa9431dea3d3a442b75b2eb2be751b8224da4ffe50feba044453fa259ebe27b05c97a393faf775e13ff4d4dc9edd427adbbe6df0b0a7ce5b5617d12b4d7") prctl$PR_SCHED_CORE(0x3e, 0x2, r7, 0x3, &(0x7f0000001340)) ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f0000001380)={{}, 0x2, 0x100, 0x7}) sendmsg$AUDIT_GET(r4, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x10, 0x3e8, 0x800, 0x70bd2c, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x801}, 0xc4020) syz_usb_control_io$hid(r5, &(0x7f0000001680)={0x14, &(0x7f00000014c0)={0x0, 0xc, 0x91, {0x91, 0x2, "bf8a7baaa4088567d00182d3e815479659794d36fe7f730ad6de5fd799f1a3b93a96b2c91cc8ebd1ec7892a89ab173f235038e659790496905e5280cd49873bb1fb0d28b04a4edb2facd6b08f0dd2b0b683dd78a2b96b0e71fe399ac3e48b0a0e686449dbeaacc524b2a3445439242a6d2e4b9ca3fa03d0d00d82dfdd2a16d1b06733b6b8f1a1fa19ce61d7fc653a0"}}, &(0x7f0000001580)={0x0, 0x3, 0x47, @string={0x47, 0x3, "d9dabd3d8c27dec12802ebc74af718c8f91973247e67a1d5cbe1652c2429efde1389726fbe16474c83fbfb71d7b5dcf12b2d41304f7350dcbf559a8ef80c8f40677e897591"}}, &(0x7f0000001600)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x2, "8a19f4d3"}]}}, &(0x7f0000001640)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0xd3, 0x1, {0x22, 0x94a}}}}, &(0x7f0000001900)={0x18, &(0x7f00000016c0)={0x60, 0xb, 0xea, "f06573a3583a84fbfd7f6544581f07064855111f2b429fb7ab5ae9c39629f1e2e8fe721bf43c5ae9cb06f0ccc1ee84cc1935d5e4cabde77d9b94d7327ac6edf9dfd58e9aaeca4a43c0fcf0c54bbde5599aa9a0e0002484e163e270ac8004eef84c05ef9de2c8ae6b213fcaaef29374ede86fe8ec930a49802bea156742fe161f06325a8c23b168c4a181f5081f0a99e04de815e6aadea33877cbd7561f3b01381513e5edf0a6d45a038a721eba8042e33ed90103dbe8a486f3a1edb3524f05b11c81f5a18e86441e86d3ea7b47b681e81e4f8fe49f67d977e90fc879ae4e03e8735d836bed5f0acab0f3"}, &(0x7f00000017c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000001800)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000001840)={0x20, 0x1, 0x4b, "549d3ebb61a266bffa84ee85e5002e5f7170c8f9f80a4371ed38ae0ba39517bc0a05c318e54bc805ded3cc0f3c6340fd23f18c070320d6dea3a7d7157e231a8bddf28df9ef5e60db3f295e"}, &(0x7f00000018c0)={0x20, 0x3, 0x1, 0x2}}) recvmsg$can_j1939(r4, &(0x7f0000003c40)={&(0x7f0000001940)=@qipcrtr, 0x80, &(0x7f0000003bc0)=[{&(0x7f00000019c0)=""/4096, 0x1000}, {&(0x7f00000029c0)=""/211, 0xd3}, {&(0x7f0000002ac0)=""/158, 0x9e}, {&(0x7f0000002b80)=""/47, 0x2f}, {&(0x7f0000002bc0)=""/4096, 0x1000}], 0x5, &(0x7f0000003c00)=""/36, 0x24}, 0x10163) r8 = fspick(r1, &(0x7f0000003c80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r9 = fsmount(r8, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000003ec0)={0x14, &(0x7f0000003d00)={0x40, 0x5, 0xd1, {0xd1, 0xe, "58ed84bcae27e005a352b1cfe8611011227e69be5ca4669fc8d0f07b99164edf8c257c846183883152c8dfacfb55c3391b86ddb7661a8e279ce9c2b75c133e74d7751ab327307dd3c24d884e93993c7d7c79168a2d0ba8124ee924925c63ee1fc84a57293036276b85261a4773017c9071484161bbc4b171453720a3371ad60ce451af4950654452e12dfe9295269912f7fed76d272f2f9aaa8728f8e3999c94e4070ae1fe2bdab5a88651338f07a627011ac348c0b765a0d580a953e4319fe0c65aa03d645a0ee33d8772b0eeaf99"}}, &(0x7f0000003e00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1f905d6be9045ba1}}, &(0x7f0000003e40)={0x0, 0x22, 0xc, {[@global=@item_4={0x3, 0x1, 0x3, "aabe0473"}, @global=@item_4={0x3, 0x1, 0x4, "8dc828ee"}, @local=@item_012={0x1, 0x2, 0x9, "e7"}]}}, &(0x7f0000003e80)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9, 0xf, 0x1, {0x22, 0x2d7}}}}, &(0x7f0000004140)={0x18, &(0x7f0000003f00)={0x0, 0x31, 0x93, "72bc68c9aff92608294761941c32771ef02c7dd22b61c479152358bb8712a4718260efde939c3b1e62c55bec0e3014503b12bd0d30bf6a7903a0f745b650bd3d943fd07bb88b0d60187d63a4f5b8dac798739644d74ba23338b633fae71a7f50bc44e6842d245a9f3cec31cc194eb00098c309f6155afb6a37b077b0d7b51ada2509d50713d1c103a16d84e339345dc26c73c1"}, &(0x7f0000003fc0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000004000)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000004040)={0x20, 0x1, 0xa9, "710a6daa4dff1698e6634c95582dcf6f07b3bf71c93fbd423cdf4fe9c800422ba4599b33f48b9117a05b9699662e5cad68f70a77998a5d63e7945cfbeb5f975b1dd8b65627bdba5d6005df0ccf47b44626cfd0db865a306113be3cff75875d889878a3ad4bfbdd16229a8705d5ece192bdd369e6d46d6785840d25b02daa8dbdc008669286126711d21d7840bfe259227f8604a58b407cc27bbb004b2ecfd4a5fa7cc93189adef36b1"}, &(0x7f0000004100)={0x20, 0x3, 0x1, 0x4}}) recvmsg$can_j1939(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000004300)=[{&(0x7f0000004180)=""/228, 0xe4}, {&(0x7f0000004280)=""/113, 0x71}], 0x2, &(0x7f0000004340)=""/57, 0x39}, 0x40000040) setns(r9, 0x80) 4.670632166s ago: executing program 0 (id=2135): r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000300)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r5, 0x0, 0x0}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000600)={'ip6_vti0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x0, 0xf7, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x700, 0x8000, 0x3, 0x3}}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r9, 0x6, 0x1e, 0x0, &(0x7f0000002000)) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x100}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pipe2$watch_queue(&(0x7f0000000100), 0x80) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001900)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r12, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) 3.74854482s ago: executing program 4 (id=2136): unshare(0x20000400) r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) r1 = gettid() r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) unshare(0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) r5 = socket$can_raw(0x1d, 0x3, 0x1) unshare(0x4a010d80) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x7, &(0x7f0000000100)=0x43, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000180)={&(0x7f00000005c0)={0x1d, r6}, 0x10, &(0x7f0000000140)={&(0x7f0000000040)=@canfd={{}, 0x0, 0x3, 0x0, 0x0, "f124a6bed4a6e874c28a9af81606b403693c64c130d1c03d41c1da8ebbbd090ffdef352b1d82f25c7719aa569b4e29f1b1c3200d701547228df8a88f7c32e749"}, 0x48}, 0x2, 0x0, 0x0, 0x80}, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) sendfile(r8, r7, &(0x7f0000002080)=0x3a, 0x23b) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={r4, 0xae}, 0x8) mq_notify(r0, &(0x7f00000000c0)={0x0, 0x27, 0x4, @tid=r1}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x44, &(0x7f00000001c0)=ANY=[@ANYBLOB="af27e4f1ac6e846fabac8201b9e5795121aca509c7b9ba663d5ec4f1ba"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r9, 0x80015b12, 0x0) mq_notify(r0, &(0x7f00000003c0)={0x0, 0x20, 0x1}) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') ioctl$NS_GET_USERNS(r10, 0xb701, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x300, 0x1b, 0xff, 0x34, 0x10, 0x61d, 0xc160, 0xb874, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x5, 0x20, 0xd0, 0x8, [{{0x9, 0x4, 0xd3, 0x7, 0x1, 0x37, 0xc5, 0x4a, 0x0, [], [{{0x9, 0x5, 0x9, 0x3, 0x3df, 0x5, 0x3c, 0x7}}]}}]}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) 3.570903628s ago: executing program 2 (id=2137): unshare(0x20000400) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) gettid() socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) unshare(0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x44, &(0x7f00000001c0)=ANY=[@ANYBLOB="af27e4f1ac6e846fabac8201b9e5795121aca509c7b9ba663d5ec4f1ba"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x80015b12, 0x0) 3.127418446s ago: executing program 0 (id=2138): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="aa000000", @ANYRES16=r0, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32=r2, @ANYBLOB="080026009409000008002600850900000800270000000000050018010e0000000800a000050000000500190105000000080027000700000008002600a4150000080026001b1700000800b7"], 0xb0}}, 0x0) 3.051488267s ago: executing program 0 (id=2139): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() sendmsg$unix(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) r6 = syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r6, 0x402c5639, &(0x7f0000000b40)={0x0, 0x2}) setsockopt$sock_attach_bpf(r3, 0x1, 0x2a, &(0x7f0000000100)=r5, 0x4) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x3, 0x0, 0x3, 0x2}, 0x10}, 0x1, 0x7}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="3400000010001fff000000000800000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468"], 0x34}}, 0x0) connect$l2tp6(r5, &(0x7f0000000180)={0xa, 0x0, 0x43, @private2={0xfc, 0x2, '\x00', 0x1}, 0xfffff3ee}, 0x20) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000000), 0x4) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4800000010001fff00000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.712414298s ago: executing program 0 (id=2140): syz_usb_connect(0x3, 0x36, &(0x7f0000000580)=ANY=[], 0x0) 2.510943628s ago: executing program 3 (id=2141): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x100000e, 0x59032, 0xffffffffffffffff, 0x0) set_mempolicy(0x2, &(0x7f0000000080)=0x4716, 0x3) r0 = syz_open_dev$vim2m(&(0x7f0000005080), 0xfff, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x12, 0x1, 0x0, "0304ac81d1607d09838ff3cfaf4dbdc1d4f6b02537916d26a489b762298d6b3e", 0x30385056}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x4, 0xffffffff}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100280c20bd7000fddbdf25030000800800", @ANYRES32=r7, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c65723000000000000008000500070000000a0018000303030303030000"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) close(r8) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r9 = openat$dlm_control(0xffffff9c, &(0x7f0000000180), 0x115000, 0x0) r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x444, 0x24c, 0x111, 0x4b4, 0x24c, 0xd4feffff, 0x37c, 0x20a, 0x278, 0x37c, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [0xffffff00], 'pimreg0\x00', 'team_slave_0\x00', {}, {}, 0x3c}, 0x0, 0x1f0, 0x24c, 0x0, {}, [@common=@srh1={{0x8c}, {0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [], [], [], 0x122}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x28, 0x75085b3011a8b5a4}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@local, [0xff, 0xffffff00, 0xffffff00], 0x4e22, 0x4e20, 0x4e20, 0x4e20, 0x4, 0x0, 0x9, 0x1, 0xf29}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @dev, [0x0, 0x0, 0xff000000], [], 'veth0_to_hsr\x00', 'bridge_slave_1\x00', {}, {}, 0x0, 0xfe, 0x5}, 0x0, 0xc8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0xfffffffd, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x4a0) ioctl$KVM_GET_VCPU_EVENTS(r9, 0x8040ae9f, &(0x7f00000001c0)=@arm64) ioprio_set$pid(0x3, 0x0, 0x0) syz_fuse_handle_req(r1, &(0x7f0000006080)="4a0a189358d611e327c887999a4e3dd594b5a85513d6c7be6efb14e77a230e88a0bd07ddbd31fb6c3deeb94e89e392181c42929c957da7d94a2c2daf077594575b5f57495caf978d8b0c93f0a453bbec8a816afcc50fa6c2546dacc17fb2cc0df836dc4a5b391b8124f318dcd05b0b6fec81ed6f67d88ca000fd23e9e2a2aaf61e6dbf4da8668b9e93c651b83e0793e51612f360aee573d7676185e23bb885f5b6e9b2fc762cf326696c5e3a301bae77ae20135d90e2bb76043a9f4c8cd13eb49816e96c8404acd0f9cd9786598fae6b0a94ca687c944ee0ba09e5754df3d51c3e28be316ce79020a065ba2eb3247357fe4415ff77aa9d77a4d8a4ab679203e3c5652aa1c0f66afba0871e6559a31638ff757593742b535e3f95226ad31a7c10bb1eba74c6112656c0fe843ecc2a40a21571219ccc222246a5279e966739ee8406d5994ec00d3fbb66cd26a82e34117b4e6d37bd926976ea02816380079a040b5c36095a8980a5b8546fd0896129c3b3bb818527dc0edc7304faeec9c7dd930e50c83a8425b7776bbeb8acc40bf578e39e0a2d4be0619bff734bc6a0840823b813b65b76af1c559f8a892eb33ecbced896bba52d941a29a2a1fda22f80ade26485bc0223cb1f11778c523c1953f178550d12ae3d38367ad0f14eb4074282ac44fcf06280aefc66a84fa780ebd52c03b52cecbb0fd15f01ec3c503ca214f03d87e4ca2e7123585cce838eb4163d131638307d62fd888a10fd0e554cad525e19c2c2fe4dfa3885a732a50e93038a8c819aa135bfb4bc285c450071fc9897b3abef89e8ca29d5755bc6a48c2dc3f49d355e82f0cdd40f6de8d64c5a005acc1fc75b8666009093a44c9db2891afece456f98c1058c1c31503f14b369564bad70b26371c25f4258d87b1962be4977ac59f6af51e265d002cc90c297eb67b439a04dd343f55389fa77ef270c073b6bf43ff4ad3a7eb3218555deaa0d374aad660ad9c70e72050166af9c4d95bad9738a8b1dcfe6722c6afc57c01175b03b1fbcfde796c3cd6057a3c3d50e974307f30fd668c356ef51116621d3cd0ad489bca45a21b99edee8313cc5856b589a8a6dbdc368eba8f727be53dfce600922da40e77bc7ae4e19e9e601345b0acba5dba63d01ca23568d67ca8f8665613c8a83e0f660a9c0c260662c9b4c48fdabbaa0afbd0b0ba9349ee741d473ed009f48389456f880fbc3ad928dca7a68895d6bc05afee258c7d1fbfa74bbe7028b32d4f4ed194b552bb77b79522e57a7ff1237a72375ed12c8d5925f2b657b1f21410054b0b09adefd84ea3125de4288f78fbe9496e84b1b9b407ab3e6f27161f1a86f874305f84b51e443d93ca12b0d3319ddc0acd729be9449939ae20f4322a1488484a0511e9a6d9721f7512273c27fca2174471434e186a1f11840b93fc349595de38bfb328e7c7ab266002ebbc15e573887c7887233b875440b7c4b65672768fbc90a1ba028eda7ab1bf2de64565bb2453c2d3260d1d5c1fd57211c7c054c5980ad1e29e945c614b90e16c6f62fb409bc76590cf915d5ac7e70388b9d39844de75cb5a0fa93ef7362100b9a3041708e535f75a86c30b17825aa1a18db7877deaa1913b817a51bc51ff532fa6219a79ac5d87e7a9ae5f7607630367a8a9da8710ed03fd620dd9bb19fbc35a1c041c3ae6fc4494de6f960ee52bf4192c618d552901960b6b0a6a102410a478a3f0e147bc36e568875910c5671600a8de13fc19c70286e1d898d2f57a8d6f3bb8b5d855f91fc30fa48cdec50fcf1fa1db3365a6b32d5aee76108257cf47b13b8a866cf5195c9d7caf0dfc9fa2dd3eb550c66ce95a2e6edd2613a412a7b46722be8b3fde2416f5496386f0f60d316174a9e76cb0bee64f92b1af795a22254fae5f28a9c8f6073bcf491ad9cb665cb74389ac3398993791ab42eb3b4b394afacfd1108921fd8551a7808e53be79b2063ea68904a93689447f1701b7ecb620bac4f73e5431dba505614823bfca82de985b960c455321da5cedf235aa858c7a3cc83c388486211be8d4ae2c9123a99e190a88ec0e00ce6041a41cee2bd0e81df89bcfb4f764013ea17430e77789cfdb5c62e8cca40e86fb187a1dea14888d0c38e6235e152f843939e5c2f5262c2b7d43c6edaac9f85b442accbd84552d68222cf3ca6abc519ffc9bdf903fd48a02fda6e8419990f3fd8d8cfd01541c40dd3697517633f80ac564ebd1690f683d5c55d56b54e89fb8166e2c07231a607305825388b0c1d41ed8035792e0da09887bb620d3aa83be3fa72eb6eee830d274e1c65f930f9f81b72115b018de7e728f9be11fb126439718ee9e370bba0f68de7038dffc841c34390cf96c6a7c345dc7b2283282854bf3ec3cad979405a4950b5b643af7be815cd12a976b2c8f4f80726c9ff2e69bc48d630bfc65f87ddd13d744aa47bc1eaff4f346b5bac87717f5be2b99cf86534732e205926a32fe8293c97922fb02847346406c0ee2b2287d602bfb8063e19ffdd5260c9826abf3acb03027eec75fdaf9d5a0f4afd9093c53934a495c3b495547bfe5632607f6e9fa5ff8aab7664ad932d14d3ad2f6144612298356edef7575724dcf0d5c56c47a4c04e2bacb818e113d3e98d7d97dd08401df703215242ebc1678873c22e1ddb36331c8d03cf1ab5a1788c78c34ab65ece4d08542208bb0696c88ebd58fe2d62c72911a33f313de3c5621cb3fd3d79a92baf5760fd1bd79d3f0dcf31f5c9c2e09e58e8fed01d691bb2f14e9f3686ce0bedf600b5802b7b493f229e608bc42ae17ca9ac9cd676fc40724f68ae85da3e676c19b9d895ae8fe3523492b7c9b24c1ca2f04abdee65eb6b4b7890e871b03b266ae5d26a8017e910ec9d6782ac8fcd4e7d2f2fc962848902a24740631f56cd4c894c059ce30f9403bd90aa4013653e5e768247b5841f80b0e5cbbb114149a38de51841fc4071a4f178d416848435d03fe5a9aa68f9fd402c38a91d1f8473219b99068205ffe826f38eb3599ecf2a63b54e92f37926f18fe9978781883d802720d87fd34c677254344fb1b76551921bcca0925bdcbe981f1f451674e50c1515be594afed70195e68c6dc1e48295beafaa5032e0af8635a7e4ba81fa4f676ef7d08137e0a361dd57125695ebc18aa574521814451d1b7a5b75425a94afbc8c5212c8a4a26badd188617ae3dd5191f695df5efa00bd669477d1a795c5624d8f5a0f627f6c6c41178d402a8a3b5ac2eaf0956fba9b88ad3093d225baaf11f95e58c1478456f8c991ee464b7877ff2a7fdeaa1ec6c14f415ed17e020cc4159cc0ecb0ddd26500517c85b42313eb1537e4798cb622afd42cf099ec26dddad772af575716e869636e38173f098a0ae7a2ee325b669d0801f175e5d691e8c2a49b60be28ef8237893ddb86e36495deb3e8bceec7c5d8097fc3cc1fe76264846594b2d77cee38c8c9bab5ef7644220749aa785cb97ea776ab8f1a77fa60564f621a72c6efc747360102c921684c43f5bd7d85492d039ec4e3737c93f88ae30eaf0c4104429f20696725d680f23dd117ecaee9ef193bda48e29cebb54ec49697db8e0ba0c08fb55bfed83e31b6de76c7ba2b1070f8684a7e3c8aab323f31792972e190f5dd8c70701cb4297ad2f5c31b3bd52340d46bf3202c6ec5d26095b326fdda69e64bc3d89f56fdd04223b395c48dc8e8dd8fa0279054663de8d02cb4fc5cc5720ae372888c30ec1600868a8e6087673ffed58745b1cce7f83bb9864aee293d6f3bbba76c3aec108679a3663b29d509dabe35aa3737bba9bd8b6cae20a61ffd8c4ad4df07d549f067be98bc78e8089b65f2bd2699a0c2c6fae2272061418bbccb13f6c000ac7693b50d05adbaf51f8d7d281582bbc15cf291b2b8f0cdcb323ea5a522add7ea2c55c7b1e3aa42486041270da5d5fafd270045f5c608b1b72302c3a748643ab14a7883782210a8192c993eb5f0f36f65e1347f23ec38d9c62f2922e0f13049eedf1ae1bd89d51c3ab41856e20ef2d28d8b960f9fbd2c8973d7c7283609790d5ecefef6274c447304b8f370484545c49506eb74a2e9b978f7121d22f83f0f0d94d16bf37d135a680fbe47b5087a9e0d113a617fe92540399f59e6bf014559de3d7a5dd63e8631fe4a18a81b19598268bb7b4ae1047cb02b51c596f68b9b07103889382e72af809a35dd03761900f68fdc013a8a54e57697505ab8f3bd09a58ffc0ffadd3aecb22a48e479ef277a93c9029eeb798b9fee705e907f4ca61897b945fe377975164dce81b4ee2d6c6bfab756adf975af13472ea8dd1219a3fcdd9ec3b7ddefbb39e80ffb619b5f7d26f0dbe54064ef7dd8795f0b339f602e7d38297167aa55e86f302d9644b47350e390f42c615caeda486ce4cc47f51d99822f5b3ab2621601dc8f437521c0b74271e3c2f0fabab345ebe3db4f93c39330d8faa0c26d441d2b8060813222228e1b618a8d491e7d9e33af8c84dbf04f3d9395eb0e29c564dc51dee95b74757d26946c39790bab403036d43958fb24818f67dd3221bfb94c8c05b81175b91aae73862cc397649ec720fe9e637cf7fb500e5a8b8983c0c8183a11de73d61eb79ab7c8454e565ce4073596c136a0548653b5abcfe6ceb51224641df2da1745686b3d81514fcf75eebcc3e62436f4ed7f4138014c73cf004715b70e6b8c2f37444305d6ca967e608ab2bf17dc9b299bb72daf553e279d5179f672f52b936e7e98b1c875b039f98564f95c0ed93dfc5fd5e95a95fdba7b2182290d91848bb5440d6e02c26e7c2c823af757dc0a8e466778e56800a6ab950c687d32d55594fc08e8d1798323485f81f6ed680a645927b05c4502804caa786c63003a2708ccc738f346324c8567789abfd503997d675c333c9db32f0d7a974809a2687d7b473e10ee94cad4aca1c727aa2eee76be300987d73da7b295395869d09144335907723b3fb15889f9999bbd214801605218123004769bfc21238cd1babb46bbc8bf80b9fda26d0f2d37a249fff428e0cd1d2cdddc5ff6d989618759ad1c2e7266be6cd1f1f55a39f8db4fd13bd26a9c8402dc8aef37000e7b5a938d5a67edacca06e40d14a7552ae907293b3df28211e39bf2fffee458e00d6a7ef8bddd6e735ca7beb04e0256c68fb411291af8d820d9b33393572612ffa00d40e4602ab391c41a89a803d7638ef08290d67158fb0b4fb59f30a749fff6bc4db9c72c4cd6d73a91f06b65cf95e61040d7dac911db8294ed980e2d11dfb47be0a12afcd6d7e029c1dd7ef3f3df2413d06b9202bce854605696d1d482c5a3cf4d64356cc7596fd73f632baa6558083c228277e66fc4f4bfdde2638b7c44ee7408c26121fe99e04aad8d88ad2a0a08369b2f3812eaf11af521baa43b8c094b414ef75b968cf9e1f242d7468b4fe6239d21c62520cd1bcdd6e3b667210050e6c37b9b18ea76e349105b209324a6ff455dd2b6779590feaee26b5a6a61ca522411b7bc3b5fa20f75ecfbe15b6a3b66a92fdcdf6db481c392a950953df28604a2395fb5593fd20743ac08ea78d65cfcdc951e6dca9720428f2ceeb541d6b22ca1b58dd409cde34e279ebd3438e270bfb030b5d31dc0885aaf1536f1c555c06493a18b615a03d6a35f0e4931a67c30d34e30a863db2254b2e16f6f2855635bf386d0a9dcd41034923ee85d5f7fa24d05e9eb2fce5a22d4d2bdc8fef0bf71ace5a4b2b58fe6772197cdc08616d6a9bdc8ca55eda2823725981748a7e0c925605a1882cee338da7a676d623331a9390661b6ec0876a1898503b811fbcaae8433017c5cf58b96b6650175d4491ff5187a8a4a7f5f38bd60ecd63561238b250abfa32169e9a37032db4cc66d6324570dced97f5cb301bc308883dd9319d8bdbb6115f00bb6368d8ae2f42a51162287334cc0fc7e8931f02ba96e8b468893d9afd66b783728abc83184cc0c9611fcc9e92bdd16a8dec911fc50f531c290bd321d3a50cc1aafad90fb2ffcb757d3e73fc8ab86f448b2b47c52dbf77c1242dd88cc8f30735b718dc305d6e577fbf9182c2cc7e9e408617f4e2c0b3fe1f3888e07c9a143c236a5f6faa7f9ac0c4fb96a568e0793f6e58a8f58f852a42bba589544e8897144aaf6189f580e06c1d92525d4bd05856ee8ed60e5f5c3cfc8c4f904052bfea93103513ee269e3f4daf875277413dc3b3e9edf6c71067b59c052b7acaa725d68ff5242c15abcf9cc21e3eeab385014c7dabd9821b65b24f641e7280860e417191ace530f98482a6975206a60640da184b211d1dc565ba5afca0d077d44888433847719a11b660ff27fe7671cb780af1cc84aeda040592f32af77f07c5d943b50eece651a29b30cc5e22da4ec286e84e47fa9fa1c6111bfc2a507ec11d9c6cc4ec054fe0bf34e591fa385fdbab3e5c96cc592c93b24e348661265b03aeedf59689e72dc6b4c327b32de9f27c170778852747709c3b78302a8c143407fc016f39a348247e4922f9bb2b275ecfe1175bbd8a2ed0ed23af30bef7530027b8930b18b5617c5c1701a8801b7262379a75231e79560d2ac61b73ba1bdd9e8359821f981eef32ec5e4939d491947698e56683a27beecf5c4f880541114c8c4b8d099aa2d4aa8a1d1fc30c392587519d1416646cd062245f5991d4ce27b70ea18e4970e1de1a79d6893bb5c1a83142dfd96be12ceb2e3b0d702073d4454a2728c267724d186b1ee5ed31ca5f6a0129c48892c6dbbaca1cf214ab137e958fb0562a7898374f036df88a64405e913bc2974452687c8cc4a85ef379dbde5662c18d76a8a5142a3ee3d916da9b054fc23627a241abc6f117d3bee679d27adf56f5c5adfabc7546d23259abee780b9ff952a7f476c9de8e3e736c4376d2618c5f45275cba1a52f34137ad1d811d982eb6f482ea750199593b89613ee7c5a6af440b42a424996f31e3b57cd535a6348f176443ec4a0b4ef67788287be3737c90472dcad76dfd97fd2b404941c068615ea3aee9876d61f1815380887c6bfff8b56527a1ffd401077d05860285e7c1126daf1975f2bc1d34dbcc0140f6f0e141d6d3bc0d86ff4271121f4a40a93fbd45e28424dabdc3a3fff8e1fd2a4baf812e7dec91bfd2ca0468789ffb0676a741bac09c25b696f480e3686c21235e34cf3d0f71b3a6dfcc9590b40e6eba056468f3ccccd48d05719a71a8c918e7eeb9ddc5fcced9fbf0e5f6aaa3d769764a2736209da9a5b85c9639047fd683f87ab7ea926c0eca7044614ba5d3ce1f32a12908dca9dc2af065b950d6bc1fd4f9eb52078ebe89baa370d01b9b8087023e3456aaf38091c0225a1ca9b0a6a27fe0f505502258b31f60455b73be971af5c15b65ae9ea3ef071ee2332b77b6ce0863f8827f6fc46ecb577c927617630dbfa79a14fc0b7b17acb21722e28a6d8a304c2df9a1ece00c32630802543c141eb86f8a20c582e64d7ca1640aa1be5fd16b99d8ae70de827ecfb1e4487688aa72ff0cfd57d8a6b5cf79b5c63736e4caacff54985b656971df4da3f017e66f0dd232ba5f13f6777e42518d02c0e980ceff0beeda8938be4de3e5a6f487ceb2dcb7af0629a90947c72693529eb7b1a174c0d97e116d95dba05dffc020f4dd7807dddf0e6cbb168bce2ea61ec2acddd87a7c1d02ac7cf76f3f6b6991990acd7b15aff8fbd486574740f4a16ce52c970cb36445e8b806d17a4a86677e1d0681f082e90c1bcf6d10e01bab6b13d70f29f1ed0a8739383dd72afde91663d8fc962ec8fe7b25e5061aae16b8e1a5dc8e2bdf52ec7eee9f5fcb9b5f866a40e6b082146e13070571c43e20f454402ead03515aa3ac372442fd9d55ca1418540f61929ee9a02abd5a411fdf723158571f464a07dc2b0b6b78ed509e1bdd716989d74eb3fa40bf754c696dd3188b4530600d4cb23b1f2329ab4065cd5b3a5fd88c55420b90194fb52e97df2b3262ce937aa877c7a4c9e1eaa5aad7772468d6661c93102a417fc7501563185677d60496b4b1d835e429013d333be8260d81c585db684d81d6d93622670570c42c13f86f13337c76442e97e7a5b24c54161ae0a242dbc73ae41cda900ffe377f13f03eb404461af1d706e176d3b9ff7cfee61baf7522b4fdcffc3d3862410a710718e97c1d39d3423e9df86687fc84d927d15c6285e829bc56551ab3453a435c2d1fb8b46d806138c6ddf40c1ad1e686e403b4857a20b1e865a97d8299e19c4144d1330a872ae9596cf214133fd9a0d43e4d88c4e9955dad059bc2958064e8dbb5b89f988c6c51ac3e2a8cdd7eee465ddf5aee5d42c43950c0f37ead4a70c35c1ac7dbb3d32e03a1ecfba318539f76519a0224a2ebe121123aa3d6df428e518d469e1eacad4387ead730c46fab8adc9a25b58a04aeab20e60816e3604129b366685f0ed846c4f90c70d2b810bbafb3cea811caece6e1e6593df324b190befa137aa96d7f5a048d3bfbcd9afbfd95c9e7cd13b05fa8d1ce22dfa6155e21fa35cd9ba4f4ee5c52fb2f79dd0ed9b559a049ec60ba7286eab4e8f23799ccecef33d5cdd93e318f1cf4dd20ac4dd2ba16a49dd2949dc5caff80f411c2f9c3792bb202324f279b9494229ef2fce2a5c0611c8a2a6b350c071d59a257d82809294a87c79d2ff355531564b089747a61e54bf03852100976491e80bfcf45200e91ad1f4aa22f799b60a41eecfd0827c1aae7d68d60231bdb2565ccfd4207a90d59737ef892e25933f935f90d4d361f4fcc931c6d6ac8079873ebf7723b86b600d9195de5157af5fa11eb5d5bf53b308ea0b6f70e90b8279b2d98d08925b087d6b88adaf62166b535956ea99b232fedda5c68361e7c510f8a127a3eceabc31db05f15fc31bdd1aa75118107a24be0e3488a1a10335f512ad04699d4c1f8b00f75ef361ddc5dd4dfcda60350f9178a1f3f7f293359f0ae7b811d5657d8e9fb3c4dc0f195c88e0158921bd5f1580af349cd7d6898b0f85dfe9cbe4991e29b202544f6cad213a313e75245da6f8840403eaff5be13afa8e982793d8cd1cb15a427cf9c28982d580ac46706aa57579dc3413ad07833f35e66b4e3cc129c84966a9ab1b347291b5ea33d93061ecf29ff662ae8e70a57ad361bb742c956d2fe991fcb9fb4b56ec2160a508404d59835acc85424ef2f673d4003d848be4b4c2e5f63d88aff740301d66c7c0ab9313abd84c8d8eb762eec74f85619a126b680e43efa0f2058adf58cbc8afdaccdaa65060f6032c93b2ba021f747d6591032671fb93f4134723d8088926e2971953fa655a4b0d0bb25a2f4c5fe28c1b6bf9c5c8efc3c3bafee793cbdf35e2dd5859a92439684e729e38ad952dc3e610173d9f8c10e10417bc7b3362465ed3c4affa9691bcfaa09da9ea714ce845d866e3cfac351cfda1d2b8f3993d188d72b11862259f2675376e1e630c67ac1f5d08f5687ae692a8786ba66928a664275f24987feb18f7179105b22cfc1538693bf34b05fb11702176f44236ed1e4cd29711a683e076c731371b0ebb4fdc0d21f8099a28585677accd6e5d20e6a195cb9af38ecdd38493677358372c6017334e247a160762e8cb53dd6225ee5277f57518a02d71fb3ce1a4e49cbb3651b5044b4237198c51c908cb5711bd29910c5aced31e8447d9e6c4af9bdf1eb694c1130b9f9470a65c8cc162c9799360099263cb35e572559278fbeda1698182487b90ef2e8404fb4694e16b435464fefcc972476b372928b7c44a1e158db85d7f6858580bd82e4c47b61dbcf2ff910bc837293542b3c619df3dadbdf099c44c283848ff4584867de0b43fd93a137d37bf9447c2a97ec6547efa96c64550422ff5372c43112b09319e15cbfa6be172604e364676de5f50f1fe7f15740c76502471e7ade5f92be9739f91d109ad30de983d245dba6868743f9ed232acc07a76e0601b87011ad7b5b7951ceb3c128e8ca9be1601662855db03fa01de2d016bd3cb6925d8b1e945359ba0e4cede5ee0e712237215aa5382847210ab968e0ea503b39c650c97525f03380abedd02384bd65fe6b128dbcb4a27845234d94ef180dc81275817c4654751da63d5689bdfa6f360da134440cafb5eab4ca68be597d6061f011b3df0adfd3b509ab3573f315cb19065088e3af0252c29b2a1012ac7a459c0582819b650adad8ce2ce017078ef805817076e2bdc9edd30a21a1d8d4cd94c2bcced582ed2c0bb66e18edc9bdd01cb76913b96ff08c0269fc35a106b9815cce3ac367c1fdcc22ffd261a7db746c569e96289742096128e0f13c6060978cb94eaffea44bac35dd1ee26307aaa1866e49f87c443e725b256a0cf8c337d42c5bb89bff67f3d59735bd6146a23542244a1c0e9b5f86fc390c91612681605f96c9b36ee30940db3eeabddc9885863fc6bc6ea553231a78be12cd7bd9d25505b6f77367719004c55e2518a6c1e87b6b1176f2ef91dce2f6593b94c17457a4d379bdd4516de5e8678e387b0755472e2f65400982b5be9110f314514365e63f31e5013455279132dcf61cc89b67303caa45b046352bcf34e9cc2033f04ddbba2d9f971c8d3a8f79cafe19a23c4848560e2b0d748f53f34c365fce9732b2cacf129965f4adfea94a1d8370d6d55e016026b2921941ad66bbed2a3db0e3ad4d86e500b119221ab88baa41d906ec452a0411df603547e47aced3889b250e9bdf6c0fb5b95dad6b30854132fe4f4b69b879f5eb4250ac0066c5d9caa6559562adf2fca726912a7979bf29bad0368a7e471c436d804d95b4bebfc76282d49affb3419de734c2606dc334b7e4099c1f3a8da38dfe819364c787f29a230e64c8c4a4c892184e2d854d1ceb8759b2e5a31e523d82d1ead00b82c88b209fd56985b0be28088fa089cfd37f33c71126a4fd213619b3ef4aff9f77a54df78f7e51ebd8fc2f54b80dd2bbb69815896ed9d67156d789b49cd5a4bdc17e8c1970d8ce6ca4f691d37e8cfd864332fe2c1a14c8327826bde4eda26c5526e2584c70561bf0e570bdea7c4e979bc348dbc6b7f30bedd3b45515dd06329998fd66458824d3288e1e0ec1a6a21cf41d7757fadf4f093dec558d3c2c7d127156cb3111539cea74ec6071fb42a98d2413c25491fcba78c74d3e225f4345bcb9b1bb7310529bd172faeedea90cbc204c39f06ae5a481753792aa54d7fc212d4ea49c459fed4e0684e27251cfd9b71d82dcbb6d99cfd07fab6af9f6ecdc344cb8e4c4192483eb141c248eb1d44c8559c314c393ca0b4da1f20b46edfeb4ee45dce2fde7e1e9ee927edf764bd0bb62b2613f7c7aac2ca82513c4546730cbbafd6498a99e6eb4f3ab4ac8fbab0372613702a3a9e61a51ebd013a3c3160723781fa344e443f1306b583e28a76892e6120793e669cf4e5938e17331221af3aab273c35af82297f6ebf359c99de1f4bcf9837d1912b8645f2a511b70e42c29cf2b3160f769adb7b97681bbf8bb7826a2111b012aa0e8b4922a6248865c87248d5bfb3a8acfaf7edfbdae1604c42323006c67d7724d65b4f95978169cfef0ae09320414b708c3f380c98011070eaa1a8159ce987f39ed788e3c99604d6c684d022a531de9929528302565e2596df69e136d5ec", 0x2000, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) userfaultfd(0x801) 2.458173057s ago: executing program 1 (id=2142): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x17, 0x4, 0x6, 0xfffa}, 0xd, [0x1, 0xc959, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5f, 0x9, 0x2, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x7, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x24, 0x9, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x8, 0x242, 0x3, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x92a3, 0x4, 0x1, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000004, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x1000, 0xfffffffc, 0xa, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0xd, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x1, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7, 0x8000, 0x1, 0xfe000000, 0x9, 0x2, 0x7f, 0x9, 0x3, 0x3, 0x4, 0x1, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x2], [0x7, 0x6, 0x0, 0x5, 0xfffffffe, 0x100, 0x8d4, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x1, 0x8, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x3, 0x8, 0x4, 0x8001, 0x5, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0xac8, 0xbf, 0x10002, 0x3, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x200, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0x25], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x3d9, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x2, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x3, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0x0, 0xfbff, 0x3, 0x7f, 0x100, 0x9602, 0xb, 0x3, 0x4, 0x6, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x4, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f0000000380), 0x2, 0x0, 0x0, 0xf7) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000000200000", @ANYRES32, @ANYRES8, @ANYBLOB="f580c7d74505d3fe96544e4422deb1c8661aacdb515f782efe2fa0919473131d78faa6e033f8676ee2a82398b49e2f52081bd687b82105f1b8bf8148268389b46141a74991116a888d4c6968240f13d94a4aa461ce98b52200610b4fb099b653ec3655ca9a468f8747c61454e2a1a0ed42a1d3c681a0bc4ff380cc7459f91409f7288cca7522aed5edabbb54d70103055af4f13bc7b59d6a814605c4eee45da689811e828402a486e43a42a23d30a9ecee93573395ab93181787258b112a93120ce2fc545e4c47558aef7bf72fe486d3df1f321142a5c78a85ec384517264747e68cc551e2d26a89e30324edd13fd4c4773198cb221d26fad2a78e4bb10d6e27d0aa4dd8524323076315f3ca96e72c4a6ba7505e3217c2fbf36e75a7a8cd3029f558a931bf18340b70506da8afbd6d98cbb384c22442e85305910fd38260626253f4f3f3496e59dcd0a9e367870b0c715691b2c8d477cd71eed0", @ANYRES64=0x0], 0x20) io_uring_setup(0x6e6c, &(0x7f0000000080)={0x0, 0xbafe, 0x1000, 0x1000003, 0xc4}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) r3 = syz_io_uring_setup(0x8bd, &(0x7f0000000200)={0x0, 0xe823, 0x1, 0x2, 0x254}, &(0x7f0000000280), &(0x7f00000002c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000500)={&(0x7f0000005000)={[{0x0, 0x0, 0x3}]}, 0x1, 0x3}, 0x1) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)) socket(0x9, 0x5, 0xb) r4 = io_uring_setup(0x6fbd, &(0x7f0000000880)={0x0, 0x5856, 0x1, 0x1, 0x2c5}) io_uring_register$IORING_REGISTER_BUFFERS2(r4, 0xf, &(0x7f0000000940)={0x0, 0x1, 0x0, &(0x7f00000003c0), &(0x7f0000000900)=[0x80, 0x9, 0x33]}, 0x20) r5 = memfd_create(&(0x7f0000000680)='\x103q}2\x9a\xce\xaf^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99\x18\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1f\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\tRJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd99C\x9fF\x9c[M=\xa0^\xa8\xed)\xe8Z\xe8\x9b&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xc9\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8ZmH\x98\xaeb\xa5B5)\x80m\xff\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6\x05\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x19\x06U)j!\x91\'\x98\xd2kFN\xfa\x80)O\xb9(!n\x9d\x13\x15\xf1\x1a\xb8y\x14l\xd1', 0x7) ioctl$FS_IOC_RESVSP(r5, 0x402c5828, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x762}) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r5, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f00000003c0)=@ethtool_ringparam={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}}) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000580)={&(0x7f0000006000)={[{0x0, 0x0, 0x3}]}, 0x1, 0x3}, 0x1) r6 = epoll_create(0x802) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003901000008000300", @ANYRES32=r9, @ANYBLOB="10005a800c0001800400010004000200"], 0x2c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) preadv(r10, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r2, &(0x7f0000000300)={0x2000200d}) 2.318505832s ago: executing program 3 (id=2143): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, 0x48) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000180)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'pimreg\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0xfff3, 0x10}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x401, 0x7, 0x8}, {0x12, 0x3, 0x0, 0x401, 0x8001, 0x400}, 0x10a5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) r5 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x2, {0x60, 0x0, 0x0, r6, {}, {0xd, 0xa}, {0xffe0, 0x8}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x81}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000055}, 0x4000) sendmmsg$inet6(r0, &(0x7f0000003f00)=[{{0x0, 0xf, &(0x7f0000000300)=[{&(0x7f0000000140)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) 1.463217242s ago: executing program 1 (id=2144): r0 = syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) r1 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r1, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x84, &(0x7f00000003c0)={0x20, 0x23, 0x2, "f6cb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000001640)={0x84, &(0x7f00000002c0)={0x20, 0x17, 0x2, "78dc"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x4) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000380)) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f0000000600)=""/52, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/236, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/66}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x100}}}}}}}, 0x0) syz_usb_control_io(r1, &(0x7f00000004c0)={0x18, &(0x7f00000001c0)={0x40, 0x24, 0x13, {0x13, 0x7, "8993825f5804a014256fe398133bf09d23"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x400a}}, &(0x7f0000000400)={0x0, 0xf, 0x16, {0x5, 0xf, 0x16, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x4, 0x6, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x1, 0x7, 0x2}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0xe, 0x8, 0x2, 0x9, "a7c3b6dd", "12c845ed"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x18, 0x8, 0x7, 0x9, 0xf001, 0x8}}}, &(0x7f00000009c0)={0x44, &(0x7f0000000500)={0x40, 0x18, 0x4e, "6fbb01f2757b10b21df4a7b563bcfdab2bf6a670ff486a6d908fc4d069fe3cf4cf5dd3282930c752ef1406c79bcbd3385bdaa89954acdbe52c12f9f5cc19b9d9c1123ba7bcfeef9eb8b746a43924"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000005c0)={0x0, 0x8, 0x1}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0xa8, 0x5}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x7}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x40}, &(0x7f0000000700)={0x40, 0xb, 0x2, "5bdd"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xeb6}, &(0x7f0000000780)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xd}}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000880)={0x40, 0x19, 0x2, "f160"}, &(0x7f00000008c0)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000900)={0x40, 0x1c, 0x1, 0x4e}, &(0x7f0000000940)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000980)={0x40, 0x21, 0x1, 0x1}}) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000000)='x', 0x1}, {&(0x7f0000000080)="9029bc234c0176e17d9a8489e6cf4b035e7566cb216dbcd9e148c2c9cffb69adc03bd88f0de6b790f277ce66a34859db6d42303355c187b6c8dd942ea8c7f6962abf097b95556a3616e9838ffcc166b0cd", 0x51}, {&(0x7f0000000100)="e9e82358f486550ab2f917d9ae566c12c3a5bbf378be468a884cac9ad39760f5f3b2a255a98f2d72a7b30d9729237af4f5f3aa1fb24f78d1e9c7cfde31b9b20a311f334a3382e0af9016bc1731fbe25dfb1859526a74c51581d6c11a49c449c5ac13f46eed7b7b80d291218395bf5c69fd61f249b3fda9afd2badfda64ef51272b87799c406b7b03aa5c00688a96dda84779d419331886124f57638513d494506e1a7ceec026938ee9", 0xa9}, {&(0x7f0000000040)="19e7ca4bf023c0cd5844f3ee059e0d11221e86688d4adc9572290e9b50bf198dff6e111b9c45e4de67a9794912c1a8015d858bfd5aa67851", 0x38}], 0x4) 1.430301878s ago: executing program 3 (id=2145): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) setsockopt$MRT_DEL_MFC(r2, 0x0, 0xcd, &(0x7f0000000140)={@private=0xa010102, @local, 0xffffffffffffffff, "5644adcb0e1bd1220b90c6f33830203b2e60af9b407e725625fc76722764d4ee", 0x800, 0x8, 0x2, 0x5}, 0x3c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000540)={{{@in=@loopback, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x2f}, {0x0, 0x0, 0x4, 0x2, 0x0, 0x1, 0x0, 0x1}, {0xebf}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x2}}, 0xe8) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = msgget$private(0x0, 0x0) msgsnd(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00\x00\x002'], 0x0, 0x0) unshare(0x11e1d7707d6e5e8) socket$alg(0x26, 0x5, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='netpci0\x00', 0x10) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r6, &(0x7f0000000000)=""/188, 0xbc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f000024e000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x0, 0x0) syz_usb_disconnect(r5) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x21b00d3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f0000000100)={0x0, &(0x7f0000000080)}, 0x10) creat(0x0, 0x1a6) read$snapshot(0xffffffffffffffff, 0x0, 0xffffffbf) msgsnd(r3, &(0x7f0000000180)={0x3}, 0x4, 0x800) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, 0x0) poll(&(0x7f0000000000), 0x0, 0x9) 569.730144ms ago: executing program 4 (id=2146): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0xffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x44, 0xb, 0x6, 0x201, 0x0, 0x0, {0x6, 0x0, 0x42}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x44000801}, 0x4800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)=0x7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002200)={{{@in=@local, @in=@dev}}, {{@in6=@private1}, 0x0, @in6=@local}}, &(0x7f0000002440)=0xe4) sendmsg$netlink(r0, &(0x7f0000002400)={&(0x7f0000002180)=@kern={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002380)=[{&(0x7f0000002300)={0x3c, 0x1c, 0x2, 0x70bd2a, 0x25dfdc01, "", [@typed={0xf, 0x116, 0x0, 0x0, @binary="5537ff987421d44e221903"}, @typed={0xc, 0x12e, 0x0, 0x0, @u64=0x2005}, @typed={0x8, 0x1e, 0x0, 0x0, @u32=0x6}, @typed={0x8, 0xf8, 0x0, 0x0, @u32=0x1ef06b92}]}, 0x3c}], 0x1, &(0x7f0000002480)=ANY=[@ANYBLOB="1c000000010000000100000010168332167f691d8a51d67cf853e07a76663446f6af7a54e677bf2893659264c710b6149770a89a0104abdb8d502f085672ffc0e334f25bc854c52f9d3221fbdbe93536fc81ccd8846bdf46a157e764b893149334f32b8553c2288039de26af7e1c751fe0a1df9474cee0d837efee4d5b6f5f8130ac4d5aab56e9370034238c4a9b263a59c27a69582f47", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32], 0x1c, 0x40084}, 0x4000001) r3 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000180)=""/9, 0x9}], 0x1, 0x2f, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x5a101) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101282, 0x0) r8 = dup(r7) read$FUSE(r8, &(0x7f0000000140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f00000000c0)={0x50, 0xe5dd5574dbe1c0bb, r9, {0x7, 0x29, 0x6, 0x10240, 0x6, 0x5, 0xb, 0x2, 0x0, 0x0, 0x8, 0x100}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x58, r6, 0x1, 0x0, 0xfffffffe, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME={0x3c, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x6}, @broadcast, @device_a, @initial, {0x6}, @value=@ver_80211n={0x0, 0x6, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}}, 0x32, @val={0x8c, 0x18, {0x77, "245271fd63c1", @long="778789bfa5ce70db359d885eaa2e95a6"}}}}]}, 0x58}}, 0x8000) syz_usb_connect(0x3, 0x34, &(0x7f00000021c0)=ANY=[@ANYBLOB="12011001b1fb66101e090300bb35010203010902220001080540040904ce01016fda0dd8000705f71f22810b09050c0200020103"], 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0xccc43) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x54, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x888e}, @NL80211_ATTR_FRAME={0x22, 0x33, @data_frame={@msdu=@type11={{}, {}, @device_a, @device_a, @broadcast, {}, @device_b}, @a_msdu}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 444.262031ms ago: executing program 2 (id=2147): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) unshare(0x2c060000) unshare(0x24020400) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x85) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x14) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000040), 0x2, r2}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000540)={&(0x7f0000000040)=[0x0], &(0x7f0000000480)=[{}, {}], &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x1, 0x1, 0x0, r3}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000300)={0x200, 0x1, &(0x7f0000000440)=[r2], &(0x7f0000000040), &(0x7f0000000400)=[r4, r5], &(0x7f00000000c0)=[0x2, 0x6, 0xfffffffffffffff6, 0x4, 0x1, 0x3]}) 239.374334ms ago: executing program 2 (id=2148): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) socket(0x2b, 0x1, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000040), 0x12) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB='-4'], 0xc) connect$inet6(r3, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff032501", 0x2e}], 0x1) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r7, 0x100) syz_emit_ethernet(0x4e, &(0x7f00000001c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff10f5", 0x18, 0x6, 0x0, @remote, @local, {[], {{0xfffd, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@generic={0x0, 0x2}]}}}}}}}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r2, @ANYBLOB="08009e"], 0x24}}, 0x0) 187.64524ms ago: executing program 2 (id=2149): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f0000000080)={0xa, @pix_mp={0x7baec3f0, 0x1, 0x32314d59, 0x5, 0x5, [{0x9ab, 0x1}, {0xffffff8c, 0xff}, {0x200, 0x5}, {0x800, 0x9}, {0xce06, 0xa61}, {0x4}, {0x80000000, 0x6}, {0x4, 0x8}], 0x7, 0xc, 0x6, 0x2, 0x4}}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000000)=0x5) recvmmsg(r4, &(0x7f0000000740)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000480)=""/9, 0x9}], 0x1}, 0x8}], 0x2, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) socket$inet6(0xa, 0x3, 0x87) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) shutdown(r6, 0x1) ppoll(&(0x7f0000000000)=[{r6, 0x4}], 0x1, 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=2150): r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x29, 0x0, &(0x7f00000000c0)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f00000004c0)={{}, {0xeeee0000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4, 0x1}, {0x0, 0x0, 0x8}, {0x0, 0x1000, 0xe, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0xfc}, {}, {0xd000}, 0x0, 0x0, 0xeeef0000, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0xfffffffffffffffc]}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @pic={0x7f, 0x3, 0x0, 0x0, 0x0, 0x43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x4, 0xfc}}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2b, &(0x7f0000000000)='/procsys/net/\x00\x00v4\x00nN\xd4\xa2\x88\x00\xd1l,\x00'/43}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r5, &(0x7f0000000780)='\x00', 0x1, 0x4000000, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r5, &(0x7f0000000300)="9c79", 0x2, 0xfb9bf2c60d757c27, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x2) getdents64(r6, &(0x7f0000001200)=""/46, 0x2e) getdents64(r6, 0xfffffffffffffffe, 0x29) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000380)={[0x8aba, 0x2, 0x4, 0x804, 0x7, 0xf, 0x120000, 0xff, 0x0, 0x8, 0x8000000000000001, 0x2, 0x0, 0x101, 0x8, 0x1], 0x8000000, 0x145202}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @random="010000003700"}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x12, 0xffffffffffffffff, 0x0) syz_open_dev$radio(&(0x7f0000000040), 0x3, 0x2) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xe, '\x00', 0x2}) kernel console output (not intermixed with test programs): 620.654753][ T976] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 620.684124][ T976] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 620.701572][ T976] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 620.709591][ T9] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 620.732993][ T976] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 620.782653][ T976] usb 1-1: USB disconnect, device number 83 [ 620.859462][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 620.878513][ T9] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 620.896495][ T9] usb 4-1: config 0 has no interface number 0 [ 620.905742][ T9] usb 4-1: config 0 interface 12 has no altsetting 0 [ 620.922272][ T9] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 620.932634][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.941118][ T9] usb 4-1: Product: syz [ 620.945514][ T9] usb 4-1: Manufacturer: syz [ 620.955657][ T9] usb 4-1: SerialNumber: syz [ 620.966781][ T9] usb 4-1: config 0 descriptor?? [ 621.036479][ T5893] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 621.196603][ T5893] usb 3-1: Using ep0 maxpacket: 32 [ 621.204111][ T5893] usb 3-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 621.216486][ T5893] usb 3-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 621.229722][ T5893] usb 3-1: config 1 interface 0 has no altsetting 0 [ 621.240046][ T5893] usb 3-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 621.249347][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.257816][ T5893] usb 3-1: Product: ш [ 621.262014][ T5893] usb 3-1: Manufacturer: 㰁 [ 621.266911][ T5893] usb 3-1: SerialNumber: 埀 [ 621.296746][ T976] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 621.417774][T11797] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 621.452009][ T976] usb 1-1: Using ep0 maxpacket: 8 [ 621.464710][ T976] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 621.474233][ T976] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 621.485053][ T976] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 621.501682][ T976] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 621.517957][ T976] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 621.531477][ T976] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 621.541096][ T976] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.576535][T11797] usb 2-1: Using ep0 maxpacket: 32 [ 621.584256][T11797] usb 2-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 621.597309][T11797] usb 2-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 621.610879][T11797] usb 2-1: config 1 interface 0 has no altsetting 0 [ 621.621429][T11797] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 621.631194][T11797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.640668][T11797] usb 2-1: Product: ш [ 621.644920][T11797] usb 2-1: Manufacturer: 㰁 [ 621.649628][T11797] usb 2-1: SerialNumber: 埀 [ 621.760965][ T976] usb 1-1: usb_control_msg returned -32 [ 621.767642][ T976] usbtmc 1-1:16.0: can't read capabilities [ 621.806482][ T24] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 621.981827][ T24] usb 5-1: config 0 has an invalid interface descriptor of length 8, skipping [ 621.991247][ T24] usb 5-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 622.002571][ T24] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 622.018078][ T24] usb 5-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=60.41 [ 622.032278][ T24] usb 5-1: New USB device strings: Mfr=0, Product=46, SerialNumber=210 [ 622.042552][ T24] usb 5-1: Product: syz [ 622.052293][ T24] usb 5-1: SerialNumber: syz [ 622.067839][ T24] usb 5-1: config 0 descriptor?? [ 622.097225][ T5893] usbhid 3-1:1.0: can't add hid device: -71 [ 622.103556][ T5893] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 622.143051][ T5893] usb 3-1: USB disconnect, device number 78 [ 622.150646][T12624] usbtmc 1-1:16.0: control status returned 0 [ 622.283156][ T5894] usb 5-1: USB disconnect, device number 73 [ 622.501255][T11797] usbhid 2-1:1.0: can't add hid device: -71 [ 622.516519][T11797] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 622.534307][T11797] usb 2-1: USB disconnect, device number 87 [ 622.871933][T12628] veth1_macvtap: left promiscuous mode [ 622.878485][T12628] macsec0: entered promiscuous mode [ 622.910697][T12628] veth1_macvtap: entered promiscuous mode [ 622.922546][T12628] macsec0: left promiscuous mode [ 622.985424][T12628] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1913'. [ 623.016044][ T9] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 623.037764][ T9] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 623.069903][ T9] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 623.134934][ T9] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 623.199948][ T9] usb 4-1: USB disconnect, device number 108 [ 623.372032][T12639] veth1_macvtap: left promiscuous mode [ 623.378409][T12639] macsec0: entered promiscuous mode [ 623.439148][T12639] veth1_macvtap: entered promiscuous mode [ 623.458652][T12639] macsec0: left promiscuous mode [ 623.576431][ T9] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 623.586028][T12639] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1916'. [ 623.734711][ T9] usb 4-1: config 0 has an invalid interface number: 52 but max is 0 [ 623.743453][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 623.848833][ T9] usb 4-1: config 0 has no interface number 0 [ 623.899645][ T9] usb 4-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 623.935080][ T9] usb 4-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 255, setting to 64 [ 624.001475][ T24] usb 1-1: USB disconnect, device number 84 [ 624.021999][ T9] usb 4-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 624.036677][ T9] usb 4-1: config 0 interface 52 has no altsetting 0 [ 624.045210][ T9] usb 4-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 0.00 [ 624.054472][ T9] usb 4-1: New USB device strings: Mfr=0, Product=149, SerialNumber=35 [ 624.079485][ T9] usb 4-1: Product: syz [ 624.108797][ T9] usb 4-1: SerialNumber: syz [ 624.349160][ T9] usb 4-1: config 0 descriptor?? [ 624.593026][T12651] FAULT_INJECTION: forcing a failure. [ 624.593026][T12651] name failslab, interval 1, probability 0, space 0, times 0 [ 624.608414][T12651] CPU: 0 UID: 0 PID: 12651 Comm: syz.1.1920 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 624.608450][T12651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 624.608462][T12651] Call Trace: [ 624.608471][T12651] [ 624.608480][T12651] dump_stack_lvl+0x241/0x360 [ 624.608515][T12651] ? __pfx_dump_stack_lvl+0x10/0x10 [ 624.608569][T12651] ? __pfx__printk+0x10/0x10 [ 624.608600][T12651] ? __pfx___might_resched+0x10/0x10 [ 624.608629][T12651] should_fail_ex+0x424/0x570 [ 624.608655][T12651] should_failslab+0xac/0x100 [ 624.608682][T12651] __kmalloc_cache_noprof+0x73/0x370 [ 624.608704][T12651] ? assoc_array_insert+0x100/0x3450 [ 624.608735][T12651] assoc_array_insert+0x100/0x3450 [ 624.608758][T12651] ? keyring_compare_object+0x15c/0x1c0 [ 624.608782][T12651] ? assoc_array_delete+0xbe8/0x1150 [ 624.608817][T12651] ? __pfx_assoc_array_insert+0x10/0x10 [ 624.608853][T12651] ? __pfx_down_write_nested+0x10/0x10 [ 624.608884][T12651] __key_link_begin+0xe5/0x1f0 [ 624.608906][T12651] key_move+0x28b/0x8d0 [ 624.608924][T12651] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 624.608955][T12651] ? __pfx_key_move+0x10/0x10 [ 624.608970][T12651] ? fput+0x9b/0xd0 [ 624.608988][T12651] ? ksys_write+0x275/0x2d0 [ 624.609021][T12651] keyctl_keyring_move+0xd6/0x110 [ 624.609045][T12651] __do_fast_syscall_32+0xb4/0x110 [ 624.609066][T12651] ? exc_page_fault+0x5f8/0x920 [ 624.609092][T12651] do_fast_syscall_32+0x34/0x80 [ 624.609113][T12651] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 624.609135][T12651] RIP: 0023:0xf7f37579 [ 624.609152][T12651] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 624.609167][T12651] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000120 [ 624.609190][T12651] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 0000000023ec8d9b [ 624.609205][T12651] RDX: 00000000ffffffff RSI: 000000001cd0de03 RDI: 0000000000000000 [ 624.609217][T12651] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 624.609228][T12651] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 624.609240][T12651] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 624.609271][T12651] [ 624.845034][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.873577][ T9] input: syz (Stick) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.52/input/input22 [ 624.906817][ T24] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 625.116415][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.287270][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 625.299342][ T24] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 625.316060][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 625.335329][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 625.399695][T12654] trusted_key: encrypted_key: insufficient parameters specified [ 625.416490][ T24] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 625.440260][ T9] usb 4-1: USB disconnect, device number 109 [ 625.472612][ T24] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 625.498144][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.727440][ T24] usb 1-1: GET_CAPABILITIES returned 0 [ 625.756647][ T24] usbtmc 1-1:16.0: can't read capabilities [ 625.786643][T11797] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 625.933178][T12649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.957133][T12649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 625.976528][ T24] usb 1-1: USB disconnect, device number 85 [ 626.232794][T11797] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 626.284564][T11797] usb 3-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 626.461421][T12668] veth1_macvtap: left promiscuous mode [ 626.475024][T12668] macsec0: entered promiscuous mode [ 626.505697][T12668] veth1_macvtap: entered promiscuous mode [ 626.528282][T12668] macsec0: left promiscuous mode [ 626.570060][T12668] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1924'. [ 626.646506][ T5894] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 626.782872][T11797] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 626.806479][ T5894] usb 2-1: Using ep0 maxpacket: 32 [ 626.813654][ T5894] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 626.825175][ T5894] usb 2-1: config 0 has no interface number 0 [ 626.835690][ T5894] usb 2-1: config 0 interface 12 has no altsetting 0 [ 626.849641][T11797] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.849694][ T5894] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 626.874081][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.893217][ T5894] usb 2-1: Product: syz [ 626.898248][ T5894] usb 2-1: Manufacturer: syz [ 626.903485][ T5894] usb 2-1: SerialNumber: syz [ 626.908714][ T9] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 626.921959][T12674] FAULT_INJECTION: forcing a failure. [ 626.921959][T12674] name failslab, interval 1, probability 0, space 0, times 0 [ 626.940674][T12674] CPU: 0 UID: 0 PID: 12674 Comm: syz.4.1923 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 626.940704][T12674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 626.940717][T12674] Call Trace: [ 626.940726][T12674] [ 626.940736][T12674] dump_stack_lvl+0x241/0x360 [ 626.940787][T12674] ? __pfx_dump_stack_lvl+0x10/0x10 [ 626.940813][T12674] ? __pfx__printk+0x10/0x10 [ 626.940845][T12674] ? __pfx___might_resched+0x10/0x10 [ 626.940874][T12674] should_fail_ex+0x424/0x570 [ 626.940900][T12674] should_failslab+0xac/0x100 [ 626.940928][T12674] __kmalloc_cache_noprof+0x73/0x370 [ 626.940953][T12674] ? io_wq_create+0xd9/0x8c0 [ 626.940979][T12674] io_wq_create+0xd9/0x8c0 [ 626.940998][T12674] ? __percpu_counter_init_many+0x392/0x3b0 [ 626.941026][T12674] io_uring_alloc_task_context+0x2e0/0x630 [ 626.941053][T12674] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 626.941074][T12674] ? __lock_acquire+0xad5/0xd80 [ 626.941093][T12674] ? __pfx_io_wq_submit_work+0x10/0x10 [ 626.941111][T12674] ? __pfx_io_wq_free_work+0x10/0x10 [ 626.941140][T12674] __io_uring_add_tctx_node+0x350/0x560 [ 626.941165][T12674] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 626.941184][T12674] ? __fget_files+0x2a/0x420 [ 626.941204][T12674] ? __fget_files+0x39d/0x420 [ 626.941224][T12674] __io_uring_add_tctx_node_from_submit+0x93/0x130 [ 626.941247][T12674] __se_sys_io_uring_enter+0x2dd5/0x3560 [ 626.941274][T12674] ? rcu_read_lock_any_held+0xbb/0x160 [ 626.941300][T12674] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 626.941329][T12674] ? vfs_write+0xb29/0xd10 [ 626.941362][T12674] ? ksys_write+0x24e/0x2d0 [ 626.941390][T12674] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 626.941419][T12674] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 626.941441][T12674] ? __fget_files+0x2a/0x420 [ 626.941462][T12674] ? __fget_files+0x2a/0x420 [ 626.941487][T12674] ? fput+0x9b/0xd0 [ 626.941515][T12674] ? ksys_write+0x275/0x2d0 [ 626.941545][T12674] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 626.941567][T12674] ? __ia32_sys_io_uring_enter+0x21/0xf0 [ 626.941592][T12674] __do_fast_syscall_32+0xb4/0x110 [ 626.941616][T12674] ? exc_page_fault+0x5f8/0x920 [ 626.941643][T12674] do_fast_syscall_32+0x34/0x80 [ 626.941671][T12674] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 626.941695][T12674] RIP: 0023:0xf744d579 [ 626.941712][T12674] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 626.941729][T12674] RSP: 002b:00000000f502f55c EFLAGS: 00000206 ORIG_RAX: 00000000000001aa [ 626.941752][T12674] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000002517 [ 626.941767][T12674] RDX: 0000000000006b6a RSI: 0000000000000044 RDI: 0000000000000000 [ 626.941779][T12674] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 626.941791][T12674] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 626.941803][T12674] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 626.941833][T12674] [ 627.285069][ T5894] usb 2-1: config 0 descriptor?? [ 627.374007][ T9] usb 1-1: config 0 has an invalid interface descriptor of length 8, skipping [ 627.383670][ T9] usb 1-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 627.394993][ T9] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 627.441811][ T9] usb 1-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=60.41 [ 627.451508][ T9] usb 1-1: New USB device strings: Mfr=0, Product=46, SerialNumber=210 [ 627.460074][ T9] usb 1-1: Product: syz [ 627.464779][ T9] usb 1-1: SerialNumber: syz [ 627.471855][ T9] usb 1-1: config 0 descriptor?? [ 627.686667][ T9] usb 1-1: USB disconnect, device number 86 [ 628.236837][ T979] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 628.266680][T11797] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 628.396561][ T979] usb 4-1: Using ep0 maxpacket: 8 [ 628.412122][ T979] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 628.426746][T11797] usb 5-1: Using ep0 maxpacket: 8 [ 628.432289][ T979] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 628.444501][T11797] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 628.453473][ T979] usb 4-1: config 1 has no interface number 1 [ 628.460600][ T979] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 628.478629][ T979] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 628.490987][T11797] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 628.496377][ T979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.520063][ T979] usb 4-1: Product: syz [ 628.524663][ T979] usb 4-1: Manufacturer: syz [ 628.527658][T11797] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 628.531030][ T979] usb 4-1: SerialNumber: syz [ 628.554311][T11797] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 628.565944][T11797] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 628.586595][T11797] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 628.603774][T11797] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.831280][T11797] usb 5-1: usb_control_msg returned -32 [ 628.848314][T11797] usbtmc 5-1:16.0: can't read capabilities [ 629.233218][ T5894] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 629.256584][T12699] usbtmc 5-1:16.0: control status returned 0 [ 629.280151][ T5894] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 629.302478][ T5894] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 629.326573][ T5894] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 629.482561][ T5894] usb 2-1: USB disconnect, device number 88 [ 629.644327][ T976] usb 3-1: USB disconnect, device number 79 [ 629.814302][T12705] veth1_macvtap: left promiscuous mode [ 629.820885][T12705] macsec0: entered promiscuous mode [ 629.860794][T12705] veth1_macvtap: entered promiscuous mode [ 629.868586][T12705] macsec0: left promiscuous mode [ 629.876651][T11797] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 629.922012][T12705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1937'. [ 630.058638][T11797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 630.078423][T11797] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 630.101135][T11797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.134079][T11797] usb 1-1: config 0 descriptor?? [ 630.180977][T11797] pwc: Askey VC010 type 2 USB webcam detected. [ 630.401245][T11797] pwc: send_video_command error -71 [ 630.428059][T11797] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 630.476520][T11797] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 630.496431][T11797] usb 1-1: USB disconnect, device number 87 [ 630.959267][ T976] usb 5-1: USB disconnect, device number 74 [ 630.996697][T11797] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 631.178912][ T979] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 631.211598][T11797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 631.237239][ T979] usb 4-1: 2:1 : format type 16 is not supported yet [ 631.264047][T11797] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 631.292748][T11797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.305363][T11797] usb 1-1: config 0 descriptor?? [ 631.319529][T11797] pwc: Askey VC010 type 2 USB webcam detected. [ 631.338575][ T979] usb 4-1: USB disconnect, device number 110 [ 631.411021][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 631.526696][ T976] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 631.836417][ T979] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 631.875807][T11797] pwc: recv_control_msg error -32 req 02 val 2b00 [ 631.888175][T11797] pwc: recv_control_msg error -32 req 02 val 2700 [ 631.905459][ T976] usb 5-1: config 0 has an invalid interface descriptor of length 8, skipping [ 631.924947][T11797] pwc: recv_control_msg error -32 req 02 val 2c00 [ 631.931749][ T976] usb 5-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 631.952946][ T976] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 631.963240][T11797] pwc: recv_control_msg error -32 req 04 val 1000 [ 631.971491][T11797] pwc: recv_control_msg error -32 req 04 val 1300 [ 631.980770][ T976] usb 5-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=60.41 [ 631.990255][ T976] usb 5-1: New USB device strings: Mfr=0, Product=46, SerialNumber=210 [ 631.998936][ T976] usb 5-1: Product: syz [ 632.014975][ T976] usb 5-1: SerialNumber: syz [ 632.035982][ T976] usb 5-1: config 0 descriptor?? [ 632.088544][ T979] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 632.168918][ T979] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 632.188198][T11797] pwc: recv_control_msg error -32 req 02 val 2000 [ 632.210103][T11797] pwc: recv_control_msg error -32 req 02 val 2100 [ 632.226918][T11797] pwc: recv_control_msg error -32 req 04 val 1500 [ 632.234160][T11797] pwc: recv_control_msg error -32 req 02 val 2500 [ 632.257933][T11797] pwc: recv_control_msg error -32 req 02 val 2400 [ 632.266979][T11797] pwc: recv_control_msg error -32 req 02 val 2600 [ 632.294833][ T976] usb 5-1: USB disconnect, device number 75 [ 632.304908][T11797] pwc: recv_control_msg error -32 req 02 val 2900 [ 632.360149][ T979] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 632.466880][ T979] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 632.533869][T12703] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1936'. [ 632.566727][T11797] pwc: recv_control_msg error -71 req 04 val 1100 [ 632.583309][T11797] pwc: recv_control_msg error -71 req 04 val 1200 [ 632.610326][T11797] pwc: Registered as video103. [ 632.626646][T11797] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input23 [ 632.639444][ T979] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 632.669360][ T979] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 632.690443][ T979] usb 2-1: Product: syz [ 632.705099][ T979] usb 2-1: Manufacturer: syz [ 632.722672][T11797] usb 1-1: USB disconnect, device number 88 [ 632.738634][ T979] cdc_wdm 2-1:1.0: skipping garbage [ 632.764451][ T979] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 633.183799][T12738] netlink: 'syz.4.1946': attribute type 4 has an invalid length. [ 633.289412][T12740] netlink: 'syz.4.1946': attribute type 4 has an invalid length. [ 633.504025][T12745] FAULT_INJECTION: forcing a failure. [ 633.504025][T12745] name failslab, interval 1, probability 0, space 0, times 0 [ 633.566103][T12745] CPU: 1 UID: 0 PID: 12745 Comm: syz.3.1948 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 633.566135][T12745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 633.566148][T12745] Call Trace: [ 633.566157][T12745] [ 633.566165][T12745] dump_stack_lvl+0x241/0x360 [ 633.566205][T12745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 633.566240][T12745] ? __pfx__printk+0x10/0x10 [ 633.566270][T12745] ? __pfx___might_resched+0x10/0x10 [ 633.566306][T12745] should_fail_ex+0x424/0x570 [ 633.566333][T12745] should_failslab+0xac/0x100 [ 633.566360][T12745] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 633.566386][T12745] ? __alloc_skb+0x1c2/0x480 [ 633.566407][T12745] __alloc_skb+0x1c2/0x480 [ 633.566439][T12745] ? __pfx___alloc_skb+0x10/0x10 [ 633.566467][T12745] ? netlink_autobind+0xd6/0x2f0 [ 633.566493][T12745] ? netlink_autobind+0x2b0/0x2f0 [ 633.566523][T12745] netlink_sendmsg+0x638/0xcd0 [ 633.566582][T12745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.566612][T12745] ? __import_iovec+0x585/0x830 [ 633.566637][T12745] ? aa_sock_msg_perm+0x91/0x160 [ 633.566670][T12745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.566694][T12745] __sock_sendmsg+0x221/0x270 [ 633.566723][T12745] ____sys_sendmsg+0x523/0x860 [ 633.566755][T12745] ? __pfx_____sys_sendmsg+0x10/0x10 [ 633.566794][T12745] __sys_sendmsg+0x271/0x360 [ 633.566821][T12745] ? __pfx___sys_sendmsg+0x10/0x10 [ 633.566897][T12745] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 633.566920][T12745] ? lockdep_hardirqs_on+0x9d/0x150 [ 633.566946][T12745] __do_fast_syscall_32+0xb4/0x110 [ 633.566968][T12745] ? exc_page_fault+0x5f8/0x920 [ 633.566995][T12745] do_fast_syscall_32+0x34/0x80 [ 633.567028][T12745] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 633.567058][T12745] RIP: 0023:0xf742d579 [ 633.567083][T12745] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 633.567101][T12745] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 633.567140][T12745] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000780 [ 633.567154][T12745] RDX: 0000000004000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 633.567166][T12745] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 633.567178][T12745] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 633.567190][T12745] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 633.567228][T12745] [ 634.112577][T12749] trusted_key: encrypted_key: insufficient parameters specified [ 634.389577][T12759] veth1_macvtap: left promiscuous mode [ 634.395650][T12759] macsec0: entered promiscuous mode [ 634.412008][T12759] veth1_macvtap: entered promiscuous mode [ 634.418596][T12759] macsec0: left promiscuous mode [ 634.469527][T12759] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1953'. [ 634.496534][ T9] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 634.576302][T11797] usb 3-1: new full-speed USB device number 80 using dummy_hcd [ 634.658963][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 634.669472][ T9] usb 1-1: config 8 has an invalid interface number: 206 but max is 0 [ 634.680415][ T9] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 634.692971][ T9] usb 1-1: config 8 has no interface number 0 [ 634.701671][ T9] usb 1-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 634.719282][ T9] usb 1-1: config 8 interface 206 has no altsetting 0 [ 634.730028][ T9] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 634.742814][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.752591][ T9] usb 1-1: Product: syz [ 634.758048][T11797] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 634.766181][T11797] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 634.781666][ T9] usb 1-1: Manufacturer: syz [ 634.787302][ T9] usb 1-1: SerialNumber: syz [ 634.811410][T11797] usb 3-1: config 0 has no interface number 0 [ 634.828738][T11797] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 634.944182][T11797] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 255, setting to 64 [ 634.999843][T11797] usb 3-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 635.045501][T11797] usb 3-1: config 0 interface 52 has no altsetting 0 [ 635.068849][T11797] usb 3-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 0.00 [ 635.094445][T11797] usb 3-1: New USB device strings: Mfr=0, Product=149, SerialNumber=35 [ 635.127325][ T9] garmin_gps 1-1:8.206: Garmin GPS usb/tty converter detected [ 635.143258][ T9] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 635.165843][ T9] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 635.174946][T11797] usb 3-1: Product: syz [ 635.185151][T11797] usb 3-1: SerialNumber: syz [ 635.242255][T11797] usb 3-1: config 0 descriptor?? [ 635.314208][ T9] usb 1-1: USB disconnect, device number 89 [ 635.417971][ T9] garmin_gps 1-1:8.206: device disconnected [ 635.461471][T11797] input: syz (Stick) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.52/input/input24 [ 635.587506][ T5894] usb 2-1: USB disconnect, device number 89 [ 636.049778][ T979] usb 3-1: USB disconnect, device number 80 [ 636.063940][T12771] netlink: 'syz.4.1959': attribute type 4 has an invalid length. [ 636.082202][T12771] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1959'. [ 636.125292][T12771] : renamed from bond0 (while UP) [ 636.186484][T11797] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 636.219108][T12774] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1959'. [ 636.269317][ T24] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 636.290886][T12777] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1960'. [ 636.338722][T11797] usb 2-1: config 0 has an invalid interface descriptor of length 8, skipping [ 636.352051][T11797] usb 2-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 636.379374][T11797] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 636.408851][T11797] usb 2-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=60.41 [ 636.424689][T11797] usb 2-1: New USB device strings: Mfr=0, Product=46, SerialNumber=210 [ 636.433391][T11797] usb 2-1: Product: syz [ 636.439856][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 636.454888][T11797] usb 2-1: SerialNumber: syz [ 636.459870][ T24] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 636.480956][T11797] usb 2-1: config 0 descriptor?? [ 636.494953][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.529312][ T24] usb 1-1: config 0 descriptor?? [ 636.550415][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 636.729784][ T5894] usb 2-1: USB disconnect, device number 90 [ 636.761300][ T24] pwc: send_video_command error -71 [ 636.786787][ T24] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 636.810409][ T24] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 636.854112][ T24] usb 1-1: USB disconnect, device number 90 [ 637.165152][T12795] sock: sock_set_timeout: `syz.2.1968' (pid 12795) tries to set negative timeout [ 637.345221][ T24] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 637.461161][T12804] xt_CT: No such helper "snmp" [ 637.677773][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 637.688409][ T24] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 637.697920][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.710227][ T24] usb 1-1: config 0 descriptor?? [ 637.724622][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 637.746620][ T979] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 637.896613][T11797] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 637.916930][ T979] usb 3-1: Using ep0 maxpacket: 16 [ 637.931687][ T979] usb 3-1: config 8 has an invalid interface number: 206 but max is 0 [ 637.958264][ T979] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 637.996391][ T979] usb 3-1: config 8 has no interface number 0 [ 638.004151][ T979] usb 3-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 638.070561][T11797] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 638.083172][T11797] usb 5-1: config 1 has an invalid descriptor of length 79, skipping remainder of the config [ 638.099035][T11797] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 638.109538][T11797] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 41036, setting to 1024 [ 638.124776][T11797] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 638.138810][T11797] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 638.149750][ T979] usb 3-1: config 8 interface 206 has no altsetting 0 [ 638.156715][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 638.163922][T11797] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 638.173284][T11797] usb 5-1: Product: syz [ 638.181231][ T976] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 638.189424][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 638.201727][T11797] usb 5-1: Manufacturer: syz [ 638.207653][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 638.219454][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 638.228699][T12809] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 638.242233][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 638.251297][T11797] cdc_wdm 5-1:1.0: skipping garbage [ 638.260746][T11797] cdc_wdm 5-1:1.0: skipping garbage [ 638.267780][T11797] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 638.437500][ T979] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 638.451922][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.471533][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 638.473811][ T979] usb 3-1: Product: syz [ 638.482479][ T979] usb 3-1: Manufacturer: syz [ 638.496551][ T979] usb 3-1: SerialNumber: syz [ 638.507015][ T976] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 638.550344][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 638.570411][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 638.577543][ T976] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 638.593436][ T976] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 638.603798][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 638.615742][ T24] pwc: recv_control_msg error -32 req 02 val 2400 [ 638.634630][ T24] pwc: recv_control_msg error -32 req 02 val 2600 [ 638.668145][ T976] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.684350][ T24] pwc: recv_control_msg error -32 req 02 val 2900 [ 638.786833][ T979] garmin_gps 3-1:8.206: Garmin GPS usb/tty converter detected [ 638.811095][ T979] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 638.829242][ T979] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 638.850342][ T979] usb 3-1: USB disconnect, device number 81 [ 638.884129][ T979] garmin_gps 3-1:8.206: device disconnected [ 638.908376][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 638.964801][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 639.001114][ T24] pwc: Registered as video103. [ 639.017768][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input25 [ 639.088883][ T24] usb 1-1: USB disconnect, device number 91 [ 639.697380][T12830] FAULT_INJECTION: forcing a failure. [ 639.697380][T12830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 639.711978][T12830] CPU: 1 UID: 0 PID: 12830 Comm: syz.2.1978 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 639.711999][T12830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 639.712006][T12830] Call Trace: [ 639.712012][T12830] [ 639.712018][T12830] dump_stack_lvl+0x241/0x360 [ 639.712041][T12830] ? __pfx_dump_stack_lvl+0x10/0x10 [ 639.712057][T12830] ? __pfx__printk+0x10/0x10 [ 639.712080][T12830] should_fail_ex+0x424/0x570 [ 639.712096][T12830] _copy_from_iter+0x211/0x1c70 [ 639.712115][T12830] ? alloc_pages_mpol+0x4e6/0x690 [ 639.712134][T12830] ? __pfx__copy_from_iter+0x10/0x10 [ 639.712152][T12830] ? set_page_refcounted+0xa1/0x1e0 [ 639.712167][T12830] ? alloc_pages_noprof+0x136/0x190 [ 639.712181][T12830] ? page_copy_sane+0x46/0x260 [ 639.712204][T12830] copy_page_from_iter+0x7a/0x100 [ 639.712220][T12830] tun_get_user+0x1f6c/0x47c0 [ 639.712233][T12830] ? tun_get_user+0x852/0x47c0 [ 639.712252][T12830] ? aa_file_perm+0x139/0xf60 [ 639.712269][T12830] ? aa_file_perm+0x3f1/0xf60 [ 639.712285][T12830] ? __pfx_tun_get_user+0x10/0x10 [ 639.712306][T12830] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 639.712328][T12830] ? tun_get+0x1e/0x2f0 [ 639.712345][T12830] ? tun_get+0x1e/0x2f0 [ 639.712360][T12830] ? tun_get+0x27d/0x2f0 [ 639.712377][T12830] tun_chr_write_iter+0x10d/0x1f0 [ 639.712396][T12830] vfs_write+0x70f/0xd10 [ 639.712413][T12830] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 639.712430][T12830] ? __pfx_vfs_write+0x10/0x10 [ 639.712448][T12830] ? __fget_files+0x2a/0x420 [ 639.712461][T12830] ? __fget_files+0x2a/0x420 [ 639.712476][T12830] ksys_write+0x19d/0x2d0 [ 639.712490][T12830] ? __pfx_ksys_write+0x10/0x10 [ 639.712504][T12830] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 639.712518][T12830] ? lockdep_hardirqs_on+0x9d/0x150 [ 639.712533][T12830] __do_fast_syscall_32+0xb4/0x110 [ 639.712547][T12830] ? exc_page_fault+0x5f8/0x920 [ 639.712562][T12830] do_fast_syscall_32+0x34/0x80 [ 639.712575][T12830] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 639.712595][T12830] RIP: 0023:0xf748d579 [ 639.712606][T12830] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 639.712617][T12830] RSP: 002b:00000000f5116520 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 639.712632][T12830] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 00000000800000c0 [ 639.712640][T12830] RDX: 000000000000003a RSI: 00000000f747cff4 RDI: 0000000000000000 [ 639.712648][T12830] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 639.712655][T12830] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 639.712662][T12830] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 639.712679][T12830] [ 640.325551][ T24] usb 5-1: USB disconnect, device number 76 [ 640.336308][ T976] usb 1-1: new full-speed USB device number 92 using dummy_hcd [ 640.455892][T12838] FAULT_INJECTION: forcing a failure. [ 640.455892][T12838] name failslab, interval 1, probability 0, space 0, times 0 [ 640.477358][T12838] CPU: 1 UID: 0 PID: 12838 Comm: syz.4.1981 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 640.477389][T12838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 640.477402][T12838] Call Trace: [ 640.477420][T12838] [ 640.477429][T12838] dump_stack_lvl+0x241/0x360 [ 640.477467][T12838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 640.477495][T12838] ? __pfx__printk+0x10/0x10 [ 640.477529][T12838] ? __pfx___might_resched+0x10/0x10 [ 640.477558][T12838] should_fail_ex+0x424/0x570 [ 640.477584][T12838] should_failslab+0xac/0x100 [ 640.477614][T12838] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 640.477642][T12838] ? __alloc_skb+0x1c2/0x480 [ 640.477666][T12838] __alloc_skb+0x1c2/0x480 [ 640.477692][T12838] ? __pfx___alloc_skb+0x10/0x10 [ 640.477713][T12838] ? netlink_autobind+0xd6/0x2f0 [ 640.477739][T12838] ? netlink_autobind+0x2b0/0x2f0 [ 640.477772][T12838] netlink_sendmsg+0x638/0xcd0 [ 640.477813][T12838] ? __pfx_netlink_sendmsg+0x10/0x10 [ 640.477844][T12838] ? __import_iovec+0x585/0x830 [ 640.477870][T12838] ? aa_sock_msg_perm+0x91/0x160 [ 640.477904][T12838] ? __pfx_netlink_sendmsg+0x10/0x10 [ 640.477929][T12838] __sock_sendmsg+0x221/0x270 [ 640.477959][T12838] ____sys_sendmsg+0x523/0x860 [ 640.477991][T12838] ? __pfx_____sys_sendmsg+0x10/0x10 [ 640.478031][T12838] __sys_sendmsg+0x271/0x360 [ 640.478058][T12838] ? __pfx___sys_sendmsg+0x10/0x10 [ 640.478138][T12838] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 640.478161][T12838] ? lockdep_hardirqs_on+0x9d/0x150 [ 640.478187][T12838] __do_fast_syscall_32+0xb4/0x110 [ 640.478210][T12838] ? exc_page_fault+0x5f8/0x920 [ 640.478239][T12838] do_fast_syscall_32+0x34/0x80 [ 640.478263][T12838] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 640.478285][T12838] RIP: 0023:0xf744d579 [ 640.478304][T12838] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 640.478321][T12838] RSP: 002b:00000000f50d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 640.478344][T12838] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 640.478358][T12838] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 640.478370][T12838] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 640.478382][T12838] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 640.478394][T12838] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 640.478433][T12838] [ 640.768521][ T976] usb 1-1: config 0 has an invalid interface number: 52 but max is 0 [ 640.778776][ T976] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 640.795801][ T976] usb 1-1: config 0 has no interface number 0 [ 640.802313][T11797] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 640.812029][ T976] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 640.824598][ T976] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 255, setting to 64 [ 640.838494][ T976] usb 1-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 640.853210][ T976] usb 1-1: config 0 interface 52 has no altsetting 0 [ 640.863146][ T976] usb 1-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 0.00 [ 640.872653][ T976] usb 1-1: New USB device strings: Mfr=0, Product=149, SerialNumber=35 [ 640.881243][ T976] usb 1-1: Product: syz [ 640.885433][ T976] usb 1-1: SerialNumber: syz [ 640.893020][ T976] usb 1-1: config 0 descriptor?? [ 640.976624][T11797] usb 4-1: Using ep0 maxpacket: 16 [ 640.984717][T11797] usb 4-1: config index 0 descriptor too short (expected 69, got 36) [ 640.993028][T11797] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 641.003213][T11797] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 641.022639][T11797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 641.046373][T11797] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 641.082300][T11797] usb 4-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 641.096092][T11797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.107818][T11797] usb 4-1: Product: syz [ 641.112193][T11797] usb 4-1: Manufacturer: syz [ 641.126589][ T976] input: syz (Stick) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.52/input/input26 [ 641.139631][T11797] usb 4-1: SerialNumber: syz [ 641.150594][T11797] usb 4-1: config 0 descriptor?? [ 641.186083][T11797] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 641.297020][ T5894] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 641.516418][ T5894] usb 5-1: Using ep0 maxpacket: 32 [ 641.530202][ T5894] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 641.533985][ T24] usb 1-1: USB disconnect, device number 92 [ 641.561872][ T5894] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 641.573196][ T5894] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 641.585315][T12844] af_packet: tpacket_rcv: packet too big, clamped from 76 to 4294967272. macoff=96 [ 641.612532][ T976] usb 2-1: USB disconnect, device number 91 [ 641.613185][ T5894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 641.654581][ T5894] usb 5-1: config 0 descriptor?? [ 641.665395][ T5894] hub 5-1:0.0: USB hub found [ 641.910566][T12842] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1982'. [ 641.980614][ T5894] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 642.003086][T11797] input: gspca_pac7302 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input27 [ 642.011420][ T5894] usbhid 5-1:0.0: can't add hid device: -71 [ 642.091568][ T5894] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 642.149488][ T5894] usb 5-1: USB disconnect, device number 77 [ 642.327519][T11797] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 642.430975][ T24] usb 4-1: USB disconnect, device number 111 [ 642.605484][T11797] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 642.638086][T11797] usb 2-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 642.701245][T11797] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 642.734791][T11797] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 7 [ 642.814822][T11797] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9272, setting to 1024 [ 642.868013][T11797] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 642.901475][T11797] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 642.919937][T11797] usb 2-1: Product: syz [ 642.924190][T11797] usb 2-1: Manufacturer: syz [ 642.970902][T11797] cdc_wdm 2-1:1.0: skipping garbage [ 642.986568][T11797] cdc_wdm 2-1:1.0: skipping garbage [ 643.002659][T11797] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 643.516584][T11797] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 643.535220][T12874] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1992'. [ 643.676641][T11797] usb 4-1: Using ep0 maxpacket: 32 [ 643.805035][T12878] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1993'. [ 643.826114][T11797] usb 4-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 643.838270][T11797] usb 4-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 643.851773][T11797] usb 4-1: config 1 interface 0 has no altsetting 0 [ 643.868114][T11797] usb 4-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 643.883980][T11797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.892925][T11797] usb 4-1: Product: ш [ 643.900421][T11797] usb 4-1: Manufacturer: 㰁 [ 643.905453][T11797] usb 4-1: SerialNumber: 埀 [ 643.968642][T12878] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1993'. [ 644.180251][T12882] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1994'. [ 644.408748][T12884] FAULT_INJECTION: forcing a failure. [ 644.408748][T12884] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 644.424339][T12884] CPU: 0 UID: 0 PID: 12884 Comm: syz.2.1995 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 644.424370][T12884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 644.424381][T12884] Call Trace: [ 644.424389][T12884] [ 644.424399][T12884] dump_stack_lvl+0x241/0x360 [ 644.424434][T12884] ? __pfx_dump_stack_lvl+0x10/0x10 [ 644.424462][T12884] ? __pfx__printk+0x10/0x10 [ 644.424503][T12884] should_fail_ex+0x424/0x570 [ 644.424530][T12884] prepare_alloc_pages+0x220/0x610 [ 644.424560][T12884] __alloc_frozen_pages_noprof+0x162/0x5b0 [ 644.424592][T12884] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 644.424624][T12884] ? __mutex_lock+0x380/0x10c0 [ 644.424665][T12884] alloc_pages_mpol+0x339/0x690 [ 644.424699][T12884] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 644.424720][T12884] ? aa_file_perm+0x3f1/0xf60 [ 644.424754][T12884] ? page_copy_sane+0x46/0x260 [ 644.424783][T12884] alloc_pages_noprof+0x121/0x190 [ 644.424813][T12884] anon_pipe_write+0xc55/0x14f0 [ 644.424864][T12884] ? __pfx_anon_pipe_write+0x10/0x10 [ 644.424888][T12884] ? common_file_perm+0x1a6/0x210 [ 644.424918][T12884] ? bpf_lsm_file_permission+0x9/0x10 [ 644.424947][T12884] vfs_write+0x70f/0xd10 [ 644.424975][T12884] ? __pfx_anon_pipe_write+0x10/0x10 [ 644.425002][T12884] ? __pfx_vfs_write+0x10/0x10 [ 644.425025][T12884] ? __fget_files+0x2a/0x420 [ 644.425046][T12884] ? __fget_files+0x2a/0x420 [ 644.425074][T12884] ksys_write+0x19d/0x2d0 [ 644.425098][T12884] ? __pfx_ksys_write+0x10/0x10 [ 644.425133][T12884] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 644.425153][T12884] ? lockdep_hardirqs_on+0x9d/0x150 [ 644.425174][T12884] __do_fast_syscall_32+0xb4/0x110 [ 644.425195][T12884] ? exc_page_fault+0x5f8/0x920 [ 644.425216][T12884] do_fast_syscall_32+0x34/0x80 [ 644.425234][T12884] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 644.425252][T12884] RIP: 0023:0xf748d579 [ 644.425272][T12884] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 644.425285][T12884] RSP: 002b:00000000f511655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 644.425303][T12884] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 644.425315][T12884] RDX: 00000000fffffdef RSI: 0000000000000000 RDI: 0000000000000000 [ 644.425327][T12884] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 644.425337][T12884] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 644.425346][T12884] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 644.425369][T12884] [ 644.892098][T12889] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1997'. [ 644.915966][T12889] FAULT_INJECTION: forcing a failure. [ 644.915966][T12889] name failslab, interval 1, probability 0, space 0, times 0 [ 644.934303][T11797] usbhid 4-1:1.0: can't add hid device: -71 [ 644.946437][T11797] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 644.965248][T11797] usb 4-1: USB disconnect, device number 112 [ 644.966071][T12889] CPU: 0 UID: 0 PID: 12889 Comm: syz.2.1997 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 644.966097][T12889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 644.966109][T12889] Call Trace: [ 644.966117][T12889] [ 644.966125][T12889] dump_stack_lvl+0x241/0x360 [ 644.966163][T12889] ? __pfx_dump_stack_lvl+0x10/0x10 [ 644.966193][T12889] ? __pfx__printk+0x10/0x10 [ 644.966220][T12889] ? __pfx___might_resched+0x10/0x10 [ 644.966245][T12889] should_fail_ex+0x424/0x570 [ 644.966269][T12889] should_failslab+0xac/0x100 [ 644.966294][T12889] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 644.966318][T12889] ? __alloc_skb+0x1c2/0x480 [ 644.966339][T12889] __alloc_skb+0x1c2/0x480 [ 644.966361][T12889] ? __pfx___alloc_skb+0x10/0x10 [ 644.966386][T12889] netlink_sendmsg+0x638/0xcd0 [ 644.966430][T12889] ? __pfx_netlink_sendmsg+0x10/0x10 [ 644.966456][T12889] ? __import_iovec+0x585/0x830 [ 644.966477][T12889] ? aa_sock_msg_perm+0x91/0x160 [ 644.966504][T12889] ? __pfx_netlink_sendmsg+0x10/0x10 [ 644.966525][T12889] __sock_sendmsg+0x221/0x270 [ 644.966551][T12889] ____sys_sendmsg+0x523/0x860 [ 644.966579][T12889] ? __pfx_____sys_sendmsg+0x10/0x10 [ 644.966612][T12889] __sys_sendmsg+0x271/0x360 [ 644.966636][T12889] ? __pfx___sys_sendmsg+0x10/0x10 [ 644.966703][T12889] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 644.966723][T12889] ? lockdep_hardirqs_on+0x9d/0x150 [ 644.966745][T12889] __do_fast_syscall_32+0xb4/0x110 [ 644.966765][T12889] ? exc_page_fault+0x5f8/0x920 [ 644.966790][T12889] do_fast_syscall_32+0x34/0x80 [ 644.966810][T12889] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 644.966850][T12889] RIP: 0023:0xf748d579 [ 644.966866][T12889] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 644.966881][T12889] RSP: 002b:00000000f511655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 644.966902][T12889] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 644.966915][T12889] RDX: 0000000004044040 RSI: 0000000000000000 RDI: 0000000000000000 [ 644.966927][T12889] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 644.966937][T12889] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 644.966948][T12889] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 644.966975][T12889] [ 645.369981][ T979] usb 2-1: USB disconnect, device number 92 [ 645.526330][ T5894] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 645.686305][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 645.718278][ T5894] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 645.740614][ T5894] usb 3-1: config 0 has no interface number 0 [ 645.770609][ T5894] usb 3-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 645.802551][ T5894] usb 3-1: config 0 interface 1 has no altsetting 0 [ 645.828584][ T5894] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 645.846590][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.865013][ T5894] usb 3-1: Product: syz [ 645.870698][ T5894] usb 3-1: Manufacturer: syz [ 645.875560][ T5894] usb 3-1: SerialNumber: syz [ 645.906969][ T5894] usb 3-1: config 0 descriptor?? [ 646.071351][T12899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2003'. [ 646.157783][ T5894] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 646.204177][ T5894] cx231xx 3-1:0.1: Failed to read PCB config [ 646.211402][ T5894] cx231xx 3-1:0.1: probe with driver cx231xx failed with error -71 [ 646.231784][ T5894] usb 3-1: USB disconnect, device number 82 [ 646.291499][T12905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2004'. [ 646.319178][T12907] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2005'. [ 646.666464][ T5894] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 646.836461][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 646.898737][ T5894] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 646.919998][ T5894] usb 3-1: config 0 has no interface number 0 [ 646.926432][ T5894] usb 3-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 646.937603][ T5894] usb 3-1: config 0 interface 1 has no altsetting 0 [ 646.964375][ T5894] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 646.984200][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.992662][ T5894] usb 3-1: Product: syz [ 646.997364][ T5894] usb 3-1: Manufacturer: syz [ 647.002425][ T5894] usb 3-1: SerialNumber: syz [ 647.013011][ T5894] usb 3-1: config 0 descriptor?? [ 647.185215][T12921] FAULT_INJECTION: forcing a failure. [ 647.185215][T12921] name failslab, interval 1, probability 0, space 0, times 0 [ 647.205485][T12921] CPU: 1 UID: 0 PID: 12921 Comm: syz.1.2009 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 647.205518][T12921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 647.205531][T12921] Call Trace: [ 647.205540][T12921] [ 647.205549][T12921] dump_stack_lvl+0x241/0x360 [ 647.205584][T12921] ? __pfx_dump_stack_lvl+0x10/0x10 [ 647.205608][T12921] ? __pfx__printk+0x10/0x10 [ 647.205638][T12921] ? __pfx___might_resched+0x10/0x10 [ 647.205666][T12921] should_fail_ex+0x424/0x570 [ 647.205691][T12921] should_failslab+0xac/0x100 [ 647.205714][T12921] kmem_cache_alloc_noprof+0x78/0x390 [ 647.205730][T12921] ? io_submit_one+0x156/0x18b0 [ 647.205744][T12921] io_submit_one+0x156/0x18b0 [ 647.205766][T12921] ? __lock_acquire+0xad5/0xd80 [ 647.205790][T12921] ? __pfx_io_submit_one+0x10/0x10 [ 647.205824][T12921] ? __might_fault+0xaa/0x120 [ 647.205853][T12921] __se_compat_sys_io_submit+0x17c/0x2f0 [ 647.205875][T12921] ? __pfx___se_compat_sys_io_submit+0x10/0x10 [ 647.205890][T12921] ? ksys_write+0x275/0x2d0 [ 647.205908][T12921] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 647.205927][T12921] ? lockdep_hardirqs_on+0x9d/0x150 [ 647.205951][T12921] __do_fast_syscall_32+0xb4/0x110 [ 647.205972][T12921] ? exc_page_fault+0x5f8/0x920 [ 647.205997][T12921] do_fast_syscall_32+0x34/0x80 [ 647.206018][T12921] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 647.206033][T12921] RIP: 0023:0xf7f37579 [ 647.206045][T12921] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 647.206056][T12921] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 00000000000000f8 [ 647.206071][T12921] RAX: ffffffffffffffda RBX: 00000000f73c7000 RCX: 0000000000000001 [ 647.206084][T12921] RDX: 00000000800005c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 647.206104][T12921] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 647.206116][T12921] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 647.206127][T12921] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 647.206155][T12921] [ 647.505701][T12923] loop2: detected capacity change from 0 to 7 [ 647.556500][T11797] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 647.572524][T12923] Dev loop2: unable to read RDB block 7 [ 647.604240][T12923] loop2: AHDI p1 p2 p3 p4 [ 647.615509][T12923] loop2: partition table partially beyond EOD, truncated [ 647.653040][T12923] loop2: p1 start 1601398130 is beyond EOD, truncated [ 647.675395][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 647.708510][T11797] usb 1-1: config 0 has an invalid interface number: 106 but max is 0 [ 647.717200][T11797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 647.717219][T12923] loop2: p2 start 1702059890 is beyond EOD, [ 647.727589][T11797] usb 1-1: config 0 has no interface number 0 [ 647.740583][T11797] usb 1-1: config 0 interface 106 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 647.752225][T11797] usb 1-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 647.766406][T11797] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 647.775759][T11797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.777064][ T5894] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 647.788278][T11797] usb 1-1: config 0 descriptor?? [ 647.798693][T12923] truncated [ 647.801881][T12923] loop2: p3 size 150995200 extends beyond EOD, truncated [ 647.821097][ T5894] cx231xx 3-1:0.1: Failed to read PCB config [ 647.922429][ T5894] cx231xx 3-1:0.1: probe with driver cx231xx failed with error -71 [ 647.954160][T11797] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 648.031180][ T5894] usb 3-1: USB disconnect, device number 83 [ 648.277482][T12936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2013'. [ 648.809576][T12933] team0 (unregistering): Port device team_slave_0 removed [ 648.871809][T12933] team0 (unregistering): Port device team_slave_1 removed [ 649.030879][ T36] usb 1-1: Failed to submit usb control message: -110 [ 649.061036][ T36] usb 1-1: unable to send the bmi data to the device: -110 [ 649.084668][ T36] usb 1-1: unable to get target info from device [ 649.106179][ T36] usb 1-1: could not get target info (-110) [ 649.135676][ T36] usb 1-1: could not probe fw (-110) [ 649.177345][T12951] veth1_macvtap: left promiscuous mode [ 649.184372][T12951] macsec0: entered promiscuous mode [ 649.190776][T12953] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2017'. [ 649.228633][T12951] veth1_macvtap: entered promiscuous mode [ 649.236067][T12951] macsec0: left promiscuous mode [ 649.265835][T12951] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2016'. [ 649.606585][T11797] usb 5-1: new full-speed USB device number 78 using dummy_hcd [ 649.770113][T11797] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 65535, setting to 64 [ 649.785704][T11797] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 649.786401][ T5894] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 649.798632][T11797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.840630][T11797] usb 5-1: Product: syz [ 649.858174][T12965] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2021'. [ 649.877438][T11797] usb 5-1: Manufacturer: syz [ 649.887074][T11797] usb 5-1: SerialNumber: syz [ 649.916526][ T979] usb 1-1: USB disconnect, device number 93 [ 649.940793][T11797] usb 5-1: config 0 descriptor?? [ 649.961679][T12953] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 650.001079][ T5894] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 650.039796][T11797] hub 5-1:0.0: bad descriptor, ignoring hub [ 650.047751][ T5894] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 650.071001][T11797] hub 5-1:0.0: probe with driver hub failed with error -5 [ 650.077813][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.122842][T11797] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input28 [ 650.137093][ T5894] usb 4-1: config 0 descriptor?? [ 650.189451][ T5894] pwc: Askey VC010 type 2 USB webcam detected. [ 650.372254][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 650.372274][ T30] audit: type=1326 audit(1744044702.016:4046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12967 comm="syz.0.2022" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf73cd579 code=0x0 [ 650.429487][ T5894] pwc: send_video_command error -71 [ 650.437786][ T5894] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 650.449238][ T5894] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 650.475698][ T5894] usb 4-1: USB disconnect, device number 113 [ 650.880112][T12974] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2023'. [ 650.973644][T12974] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2023'. [ 651.076494][ T979] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 651.284149][T12981] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 651.295804][ T979] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 651.342261][ T979] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 651.364476][T12987] veth1_macvtap: left promiscuous mode [ 651.372507][T12987] macsec0: entered promiscuous mode [ 651.396792][ T979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.451777][T12989] veth1_macvtap: entered promiscuous mode [ 651.462524][T12979] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2024'. [ 651.482395][ T979] usb 4-1: config 0 descriptor?? [ 651.489026][T12989] macsec0: left promiscuous mode [ 651.500550][ T979] pwc: Askey VC010 type 2 USB webcam detected. [ 651.816383][T11797] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 651.937061][ T979] pwc: recv_control_msg error -32 req 02 val 2b00 [ 652.016965][ T979] pwc: recv_control_msg error -32 req 02 val 2700 [ 652.062162][ T979] pwc: recv_control_msg error -32 req 02 val 2c00 [ 652.087867][ T979] pwc: recv_control_msg error -32 req 04 val 1000 [ 652.096597][T11797] usb 1-1: Using ep0 maxpacket: 32 [ 652.108398][ T979] pwc: recv_control_msg error -32 req 04 val 1300 [ 652.167801][T11797] usb 1-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 652.225832][T11797] usb 1-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 652.264284][T11797] usb 1-1: config 1 interface 0 has no altsetting 0 [ 652.282216][T11797] usb 1-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 652.292432][T11797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.364506][T11797] usb 1-1: Product: ш [ 652.380739][ T979] pwc: recv_control_msg error -32 req 02 val 2000 [ 652.406289][T11797] usb 1-1: Manufacturer: 㰁 [ 652.426559][ T979] pwc: recv_control_msg error -32 req 02 val 2100 [ 652.430303][T11797] usb 1-1: SerialNumber: 埀 [ 652.442443][T13005] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2031'. [ 652.462194][ T979] pwc: recv_control_msg error -32 req 04 val 1500 [ 652.476268][T13005] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2031'. [ 652.487687][ T979] pwc: recv_control_msg error -32 req 02 val 2500 [ 652.506584][T13005] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2031'. [ 652.517196][ T979] pwc: recv_control_msg error -32 req 02 val 2400 [ 652.530098][T13006] netlink: 'syz.4.2031': attribute type 1 has an invalid length. [ 652.546711][ T979] pwc: recv_control_msg error -32 req 02 val 2600 [ 652.557845][ T979] pwc: recv_control_msg error -32 req 02 val 2900 [ 652.802486][ T979] pwc: recv_control_msg error -71 req 04 val 1100 [ 652.829578][ T979] pwc: recv_control_msg error -71 req 04 val 1200 [ 652.936817][ T979] pwc: Registered as video103. [ 653.019466][ T979] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input29 [ 653.142096][ T979] usb 4-1: USB disconnect, device number 114 [ 653.357681][T11797] usbhid 1-1:1.0: can't add hid device: -71 [ 653.363854][T11797] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 653.456950][T11797] usb 1-1: USB disconnect, device number 94 [ 653.729489][T13019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2034'. [ 653.956348][ T5893] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 654.013025][ T24] usb 5-1: USB disconnect, device number 78 [ 654.106596][ T5893] usb 2-1: Using ep0 maxpacket: 32 [ 654.126124][ T5893] usb 2-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 654.148455][T13031] ======================================================= [ 654.148455][T13031] WARNING: The mand mount option has been deprecated and [ 654.148455][T13031] and is ignored by this kernel. Remove the mand [ 654.148455][T13031] option from the mount to silence this warning. [ 654.148455][T13031] ======================================================= [ 654.183912][ T5893] usb 2-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 654.183953][ T5893] usb 2-1: config 1 interface 0 has no altsetting 0 [ 654.208841][ T5893] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 654.219615][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.222201][T13031] fuse: blksize only supported for fuseblk [ 654.228219][ T5893] usb 2-1: Product: ш [ 654.228244][ T5893] usb 2-1: Manufacturer: 㰁 [ 654.228260][ T5893] usb 2-1: SerialNumber: 埀 [ 654.276649][ T979] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 654.448709][ T979] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 654.482827][ T979] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 654.525773][ T979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.551181][ T979] usb 1-1: config 0 descriptor?? [ 654.572385][ T979] pwc: Askey VC010 type 2 USB webcam detected. [ 654.775974][ T979] pwc: send_video_command error -71 [ 654.823293][ T979] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 654.874533][ T979] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 654.890805][ T979] usb 1-1: USB disconnect, device number 95 [ 655.170674][ T5893] usbhid 2-1:1.0: can't add hid device: -71 [ 655.194017][ T5893] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 655.207077][ T5893] usb 2-1: USB disconnect, device number 93 [ 655.289638][ T979] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 655.449607][ T979] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 655.465707][ T979] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 655.485443][ T979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.512740][ T979] usb 1-1: config 0 descriptor?? [ 655.547292][ T979] pwc: Askey VC010 type 2 USB webcam detected. [ 655.577299][ T5894] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 655.736316][ T5894] usb 4-1: Using ep0 maxpacket: 16 [ 655.743970][ T5894] usb 4-1: config 8 has an invalid interface number: 206 but max is 0 [ 655.752683][ T5894] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 655.763426][ T5894] usb 4-1: config 8 has no interface number 0 [ 655.770908][ T5894] usb 4-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 655.784503][ T5894] usb 4-1: config 8 interface 206 has no altsetting 0 [ 655.797686][ T5894] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 655.810479][ T5894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.818696][ T24] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 655.821779][ T5894] usb 4-1: Product: syz [ 655.838357][ T5894] usb 4-1: Manufacturer: syz [ 655.843222][ T5894] usb 4-1: SerialNumber: syz [ 655.850319][T13051] FAULT_INJECTION: forcing a failure. [ 655.850319][T13051] name failslab, interval 1, probability 0, space 0, times 0 [ 655.863783][T13051] CPU: 1 UID: 0 PID: 13051 Comm: syz.1.2048 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 655.863818][T13051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 655.863829][T13051] Call Trace: [ 655.863838][T13051] [ 655.863846][T13051] dump_stack_lvl+0x241/0x360 [ 655.863872][T13051] ? __pfx_dump_stack_lvl+0x10/0x10 [ 655.863888][T13051] ? __pfx__printk+0x10/0x10 [ 655.863912][T13051] ? __pfx___might_resched+0x10/0x10 [ 655.863941][T13051] should_fail_ex+0x424/0x570 [ 655.863967][T13051] should_failslab+0xac/0x100 [ 655.863993][T13051] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 655.864017][T13051] ? __alloc_skb+0x1c2/0x480 [ 655.864027][T13051] ? __dev_queue_xmit+0x1780/0x3f60 [ 655.864042][T13051] __alloc_skb+0x1c2/0x480 [ 655.864053][T13051] ? __do_fast_syscall_32+0xb4/0x110 [ 655.864076][T13051] ? __pfx___alloc_skb+0x10/0x10 [ 655.864101][T13051] ? netlink_ack_tlv_len+0x6e/0x200 [ 655.864128][T13051] netlink_ack+0x147/0xa70 [ 655.864152][T13051] ? __pfx_nl80211_join_mesh+0x10/0x10 [ 655.864182][T13051] netlink_rcv_skb+0x296/0x480 [ 655.864197][T13051] ? __pfx_genl_rcv_msg+0x10/0x10 [ 655.864211][T13051] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 655.864250][T13051] ? netlink_deliver_tap+0x2e/0x1b0 [ 655.864283][T13051] genl_rcv+0x28/0x40 [ 655.864300][T13051] netlink_unicast+0x7f8/0x9a0 [ 655.864336][T13051] ? __pfx_netlink_unicast+0x10/0x10 [ 655.864351][T13051] ? skb_put+0x114/0x1f0 [ 655.864365][T13051] netlink_sendmsg+0x8c3/0xcd0 [ 655.864394][T13051] ? __pfx_netlink_sendmsg+0x10/0x10 [ 655.864424][T13051] ? __import_iovec+0x585/0x830 [ 655.864446][T13051] ? aa_sock_msg_perm+0x91/0x160 [ 655.864476][T13051] ? __pfx_netlink_sendmsg+0x10/0x10 [ 655.864495][T13051] __sock_sendmsg+0x221/0x270 [ 655.864512][T13051] ____sys_sendmsg+0x523/0x860 [ 655.864530][T13051] ? __pfx_____sys_sendmsg+0x10/0x10 [ 655.864564][T13051] __sys_sendmsg+0x271/0x360 [ 655.864591][T13051] ? __pfx___sys_sendmsg+0x10/0x10 [ 655.864655][T13051] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 655.864668][T13051] ? lockdep_hardirqs_on+0x9d/0x150 [ 655.864683][T13051] __do_fast_syscall_32+0xb4/0x110 [ 655.864700][T13051] ? exc_page_fault+0x5f8/0x920 [ 655.864727][T13051] do_fast_syscall_32+0x34/0x80 [ 655.864750][T13051] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 655.864771][T13051] RIP: 0023:0xf7f37579 [ 655.864788][T13051] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 655.864802][T13051] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 655.864817][T13051] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 655.864826][T13051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 655.864833][T13051] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 655.864840][T13051] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 655.864848][T13051] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 655.864877][T13051] [ 655.896424][ T5893] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 656.182208][ T979] pwc: recv_control_msg error -32 req 02 val 2b00 [ 656.190366][ T24] usb 5-1: config 0 has an invalid interface descriptor of length 8, skipping [ 656.202396][ T979] pwc: recv_control_msg error -32 req 02 val 2700 [ 656.214157][ T979] pwc: recv_control_msg error -32 req 02 val 2c00 [ 656.219659][ T24] usb 5-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 656.221893][ T5894] garmin_gps 4-1:8.206: Garmin GPS usb/tty converter detected [ 656.243086][ T979] pwc: recv_control_msg error -32 req 04 val 1000 [ 656.250553][ T979] pwc: recv_control_msg error -32 req 04 val 1300 [ 656.251875][ T24] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 656.261069][ T5894] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 656.278888][ T5894] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 656.283532][ T24] usb 5-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=60.41 [ 656.316869][ T5894] usb 4-1: USB disconnect, device number 115 [ 656.333510][ T24] usb 5-1: New USB device strings: Mfr=0, Product=46, SerialNumber=210 [ 656.342839][ T24] usb 5-1: Product: syz [ 656.343644][ T5894] garmin_gps 4-1:8.206: device disconnected [ 656.351598][ T24] usb 5-1: SerialNumber: syz [ 656.371929][ T24] usb 5-1: config 0 descriptor?? [ 656.406442][ T5893] usb 3-1: Using ep0 maxpacket: 16 [ 656.414040][ T5893] usb 3-1: descriptor type invalid, skip [ 656.420697][ T5893] usb 3-1: descriptor type invalid, skip [ 656.430898][ T5893] usb 3-1: config 0 has no interfaces? [ 656.439113][ T5893] usb 3-1: New USB device found, idVendor=045e, idProduct=00f8, bcdDevice=6c.b8 [ 656.449107][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.457697][ T5893] usb 3-1: Product: syz [ 656.462020][ T5893] usb 3-1: Manufacturer: syz [ 656.466821][ T5893] usb 3-1: SerialNumber: syz [ 656.474185][ T5893] usb 3-1: config 0 descriptor?? [ 656.479744][ T979] pwc: recv_control_msg error -32 req 02 val 2000 [ 656.487335][ T979] pwc: recv_control_msg error -32 req 02 val 2100 [ 656.495816][ T979] pwc: recv_control_msg error -32 req 04 val 1500 [ 656.504424][ T979] pwc: recv_control_msg error -32 req 02 val 2500 [ 656.513671][ T979] pwc: recv_control_msg error -32 req 02 val 2400 [ 656.520801][ T979] pwc: recv_control_msg error -32 req 02 val 2600 [ 656.532559][ T979] pwc: recv_control_msg error -32 req 02 val 2900 [ 656.542098][ T976] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 656.542360][ T979] pwc: recv_control_msg error -71 req 02 val 2800 [ 656.559488][ T979] pwc: recv_control_msg error -71 req 04 val 1100 [ 656.567137][ T979] pwc: recv_control_msg error -71 req 04 val 1200 [ 656.578129][ T979] pwc: Registered as video103. [ 656.590915][ T979] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input30 [ 656.592480][ T24] usb 5-1: USB disconnect, device number 79 [ 656.626759][ T979] usb 1-1: USB disconnect, device number 96 [ 656.708751][ T976] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 656.729213][ T976] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 656.733639][T13049] xt_addrtype: ipv6 does not support BROADCAST matching [ 656.743481][ T976] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 656.756791][ T5894] usb 3-1: USB disconnect, device number 84 [ 656.771686][ T976] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 656.784332][ T976] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 656.801368][ T976] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 656.810686][ T976] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 656.859436][ T976] usb 2-1: Product: syz [ 656.873441][ T976] usb 2-1: Manufacturer: syz [ 656.904122][ T976] cdc_wdm 2-1:1.0: skipping garbage [ 656.910395][ T976] cdc_wdm 2-1:1.0: skipping garbage [ 656.919007][ T976] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 656.924947][ T976] cdc_wdm 2-1:1.0: Unknown control protocol [ 657.128429][ T24] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 657.181599][T13055] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.197374][T13055] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.242936][T13062] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2053'. [ 657.301507][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.328950][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 657.362647][ T24] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 657.394351][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 657.423491][ T24] usb 4-1: SerialNumber: syz [ 657.656996][T13058] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.704304][T13058] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.745522][T13058] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.761289][T13058] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.791716][ T24] usb 4-1: 0:2 : does not exist [ 657.856524][ T24] usb 4-1: USB disconnect, device number 116 [ 657.903732][T13074] openvswitch: netlink: Key type 30 is not supported [ 657.911741][ C1] wdm_int_callback: 973 callbacks suppressed [ 657.911767][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -75 [ 657.924501][ C1] cdc_wdm 2-1:1.0: unknown notification 182 received: index 10643 len 38080 [ 657.941441][T13074] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2057'. [ 658.108016][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 658.207720][T13076] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2058'. [ 658.527778][ T5894] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 658.586689][ T976] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 658.688673][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 65535, setting to 64 [ 658.711117][ T5894] usb 3-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 658.723637][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.733268][ T5894] usb 3-1: Product: syz [ 658.742239][ T5894] usb 3-1: Manufacturer: syz [ 658.747711][ T5894] usb 3-1: SerialNumber: syz [ 658.755113][ T5894] usb 3-1: config 0 descriptor?? [ 658.756517][ T976] usb 1-1: Using ep0 maxpacket: 32 [ 658.763249][T13078] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 658.775053][ T976] usb 1-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 658.775893][ T5894] hub 3-1:0.0: bad descriptor, ignoring hub [ 658.788012][ T976] usb 1-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 658.796350][ T979] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 658.806393][ T976] usb 1-1: config 1 interface 0 has no altsetting 0 [ 658.814289][ T5894] hub 3-1:0.0: probe with driver hub failed with error -5 [ 658.824148][ T976] usb 1-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 658.837784][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.838621][ T5894] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input31 [ 658.845911][ T976] usb 1-1: Product: ш [ 658.860797][ T976] usb 1-1: Manufacturer: 㰁 [ 658.865605][ T976] usb 1-1: SerialNumber: 埀 [ 658.886480][ T5893] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 658.902539][ C0] usbtouchscreen 3-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -1 [ 658.986474][ T979] usb 4-1: Using ep0 maxpacket: 16 [ 659.000332][ T979] usb 4-1: config 8 has an invalid interface number: 206 but max is 0 [ 659.019066][ T979] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 659.030793][ T979] usb 4-1: config 8 has no interface number 0 [ 659.042620][ T979] usb 4-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 659.056038][ T979] usb 4-1: config 8 interface 206 has no altsetting 0 [ 659.069593][ T5893] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 659.091764][ T5893] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 659.108887][ T979] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 659.118581][ T5893] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.126862][ T979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.138094][ T979] usb 4-1: Product: syz [ 659.142338][ T979] usb 4-1: Manufacturer: syz [ 659.147329][ T979] usb 4-1: SerialNumber: syz [ 659.158125][ T5893] usb 5-1: config 0 descriptor?? [ 659.166541][ C0] usbtouchscreen 3-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -1 [ 659.187826][ T5893] pwc: Askey VC010 type 2 USB webcam detected. [ 659.314114][ T5894] usb 2-1: USB disconnect, device number 94 [ 659.369599][ T5893] pwc: send_video_command error -71 [ 659.379664][ T5893] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 659.401508][ T5893] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 659.423760][ T979] garmin_gps 4-1:8.206: Garmin GPS usb/tty converter detected [ 659.440217][ T5893] usb 5-1: USB disconnect, device number 80 [ 659.455694][ T979] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 659.485041][ T979] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 659.527386][ T979] usb 4-1: USB disconnect, device number 117 [ 659.546896][ T979] garmin_gps 4-1:8.206: device disconnected [ 659.746120][ T976] usbhid 1-1:1.0: can't add hid device: -71 [ 659.770050][ T976] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 659.797131][ T976] usb 1-1: USB disconnect, device number 97 [ 659.888753][ T5893] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 659.943297][ T13] tipc: Subscription rejected, illegal request [ 659.967574][T13090] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2064'. [ 660.063384][ T24] usb 3-1: USB disconnect, device number 85 [ 660.077729][ T5893] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 660.119049][ T5893] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 660.149992][ T5893] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.179755][ T5893] usb 5-1: config 0 descriptor?? [ 660.199047][ T5893] pwc: Askey VC010 type 2 USB webcam detected. [ 660.377502][T13103] veth1_macvtap: left promiscuous mode [ 660.383661][T13103] macsec0: entered promiscuous mode [ 660.407075][T13103] veth1_macvtap: entered promiscuous mode [ 660.413942][T13103] macsec0: left promiscuous mode [ 660.566083][T13103] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2065'. [ 660.639935][ T5893] pwc: recv_control_msg error -32 req 02 val 2b00 [ 660.673396][ T5893] pwc: recv_control_msg error -32 req 02 val 2700 [ 660.734536][ T5893] pwc: recv_control_msg error -32 req 02 val 2c00 [ 660.752632][ T5893] pwc: recv_control_msg error -32 req 04 val 1000 [ 660.761548][ T5893] pwc: recv_control_msg error -32 req 04 val 1300 [ 660.914439][ T30] audit: type=1326 audit(1744044712.556:4047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13112 comm="syz.0.2072" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf73cd579 code=0x0 [ 660.979797][ T5893] pwc: recv_control_msg error -32 req 02 val 2000 [ 660.988274][ T5893] pwc: recv_control_msg error -32 req 02 val 2100 [ 661.000101][ T5893] pwc: recv_control_msg error -32 req 04 val 1500 [ 661.008029][ T5893] pwc: recv_control_msg error -32 req 02 val 2500 [ 661.019774][ T5893] pwc: recv_control_msg error -32 req 02 val 2400 [ 661.048376][ T5893] pwc: recv_control_msg error -32 req 02 val 2600 [ 661.070914][ T5893] pwc: recv_control_msg error -71 req 02 val 2900 [ 661.198062][ T5893] pwc: recv_control_msg error -71 req 02 val 2800 [ 661.218445][ T5893] pwc: recv_control_msg error -71 req 04 val 1100 [ 661.264371][ T5893] pwc: recv_control_msg error -71 req 04 val 1200 [ 661.276080][ T5893] pwc: Registered as video103. [ 661.287082][ T5893] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input32 [ 661.406406][ T24] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 661.428178][ T5893] usb 5-1: USB disconnect, device number 81 [ 661.608656][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 661.633918][ T24] usb 3-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 661.695593][ T24] usb 3-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 661.766710][ T24] usb 3-1: config 1 interface 0 has no altsetting 0 [ 661.789504][ T24] usb 3-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 661.821243][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.866727][ T24] usb 3-1: Product: ш [ 661.871015][ T24] usb 3-1: Manufacturer: 㰁 [ 661.916700][ T24] usb 3-1: SerialNumber: 埀 [ 662.239587][T13137] FAULT_INJECTION: forcing a failure. [ 662.239587][T13137] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 662.281784][T13137] CPU: 0 UID: 0 PID: 13137 Comm: syz.1.2081 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 662.281815][T13137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 662.281827][T13137] Call Trace: [ 662.281836][T13137] [ 662.281844][T13137] dump_stack_lvl+0x241/0x360 [ 662.281880][T13137] ? __pfx_dump_stack_lvl+0x10/0x10 [ 662.281907][T13137] ? __pfx__printk+0x10/0x10 [ 662.281944][T13137] should_fail_ex+0x424/0x570 [ 662.281970][T13137] _copy_to_user+0x31/0xb0 [ 662.281999][T13137] simple_read_from_buffer+0xc4/0x170 [ 662.282030][T13137] proc_fail_nth_read+0x1ef/0x260 [ 662.282055][T13137] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 662.282080][T13137] ? rw_verify_area+0x246/0x630 [ 662.282099][T13137] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 662.282122][T13137] vfs_read+0x21f/0xb90 [ 662.282151][T13137] ? __pfx___mutex_lock+0x10/0x10 [ 662.282176][T13137] ? __pfx_vfs_read+0x10/0x10 [ 662.282202][T13137] ? __fget_files+0x2a/0x420 [ 662.282222][T13137] ? __fget_files+0x39d/0x420 [ 662.282236][T13137] ? __fget_files+0x2a/0x420 [ 662.282275][T13137] ksys_read+0x19d/0x2d0 [ 662.282299][T13137] ? __pfx_ksys_read+0x10/0x10 [ 662.282323][T13137] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 662.282344][T13137] ? lockdep_hardirqs_on+0x9d/0x150 [ 662.282368][T13137] __do_fast_syscall_32+0xb4/0x110 [ 662.282389][T13137] ? exc_page_fault+0x5f8/0x920 [ 662.282415][T13137] do_fast_syscall_32+0x34/0x80 [ 662.282439][T13137] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 662.282463][T13137] RIP: 0023:0xf7f37579 [ 662.282481][T13137] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 662.282497][T13137] RSP: 002b:00000000f5056590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 662.282520][T13137] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5056620 [ 662.282533][T13137] RDX: 000000000000000f RSI: 00000000f73bcff4 RDI: 0000000000000000 [ 662.282545][T13137] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 662.282557][T13137] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 662.282568][T13137] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 662.282599][T13137] [ 662.773997][T13147] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2085'. [ 662.804429][T13147] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2085'. [ 662.834649][T13147] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2085'. [ 662.885855][T13147] netlink: 'syz.1.2085': attribute type 1 has an invalid length. [ 662.947115][ T24] usbhid 3-1:1.0: can't add hid device: -71 [ 662.953309][ T24] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 662.987884][ T24] usb 3-1: USB disconnect, device number 86 [ 663.700902][T13162] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2088'. [ 663.783534][T13162] bond0: (slave syz_tun): Releasing backup interface [ 663.898051][ T979] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 664.062477][ T5844] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 664.096657][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 664.105467][ T979] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 664.123780][ T979] usb 1-1: can't read configurations, error -61 [ 664.218749][ T5844] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 664.239786][ T5844] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 664.265778][ T979] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 664.266828][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.315709][ T5844] usb 2-1: config 0 descriptor?? [ 664.331890][ T5844] pwc: Askey VC010 type 2 USB webcam detected. [ 664.476356][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 664.484577][ T979] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 664.506405][ T979] usb 1-1: can't read configurations, error -61 [ 664.524484][ T979] usb usb1-port1: attempt power cycle [ 664.536798][ T5844] pwc: send_video_command error -71 [ 664.551162][ T5844] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 664.578660][ T5844] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 664.629386][ T5844] usb 2-1: USB disconnect, device number 95 [ 664.887718][ T979] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 664.931805][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 664.951450][ T979] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 664.970778][ T979] usb 1-1: can't read configurations, error -61 [ 665.066574][ T5844] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 665.123100][ T979] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 665.166933][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 665.179604][ T979] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 665.196784][ T979] usb 1-1: can't read configurations, error -61 [ 665.205346][ T979] usb usb1-port1: unable to enumerate USB device [ 665.235354][ T5844] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 665.259841][ T5844] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 665.272024][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.284591][ T5844] usb 2-1: config 0 descriptor?? [ 665.295334][ T5844] pwc: Askey VC010 type 2 USB webcam detected. [ 665.386330][ T5893] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 665.556590][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 665.567215][ T5893] usb 5-1: no configurations [ 665.576679][ T5893] usb 5-1: can't read configurations, error -22 [ 665.709681][ T5844] pwc: recv_control_msg error -32 req 02 val 2b00 [ 665.726317][ T5893] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 665.748080][ T5844] pwc: recv_control_msg error -32 req 02 val 2700 [ 665.824447][ T5844] pwc: recv_control_msg error -32 req 02 val 2c00 [ 665.886437][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 665.892586][ T5893] usb 5-1: no configurations [ 665.895846][ T5844] pwc: recv_control_msg error -32 req 04 val 1000 [ 665.898060][ T5893] usb 5-1: can't read configurations, error -22 [ 665.928519][ T5844] pwc: recv_control_msg error -32 req 04 val 1300 [ 665.930873][ T5893] usb usb5-port1: attempt power cycle [ 666.036684][ T24] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 666.140697][ T5844] pwc: recv_control_msg error -32 req 02 val 2000 [ 666.153182][ T5844] pwc: recv_control_msg error -32 req 02 val 2100 [ 666.161476][ T5844] pwc: recv_control_msg error -32 req 04 val 1500 [ 666.170560][ T5844] pwc: recv_control_msg error -32 req 02 val 2500 [ 666.178331][ T5844] pwc: recv_control_msg error -32 req 02 val 2400 [ 666.185589][ T5844] pwc: recv_control_msg error -71 req 02 val 2600 [ 666.193482][ T5844] pwc: recv_control_msg error -71 req 02 val 2900 [ 666.201021][ T5844] pwc: recv_control_msg error -71 req 02 val 2800 [ 666.208333][T11797] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 666.217437][ T24] usb 3-1: config 0 has an invalid interface number: 106 but max is 0 [ 666.227100][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 666.227291][ T5844] pwc: recv_control_msg error -71 req 04 val 1100 [ 666.244379][ T24] usb 3-1: config 0 has no interface number 0 [ 666.251557][ T5844] pwc: recv_control_msg error -71 req 04 val 1200 [ 666.258145][ T24] usb 3-1: config 0 interface 106 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 666.272641][ T5844] pwc: Registered as video103. [ 666.278527][ T24] usb 3-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 666.286486][ T5893] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 666.294126][ T5844] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input33 [ 666.311889][ T24] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 666.317269][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 666.333928][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.339384][ T5893] usb 5-1: no configurations [ 666.342851][ T5844] usb 2-1: USB disconnect, device number 96 [ 666.358243][ T5893] usb 5-1: can't read configurations, error -22 [ 666.359311][ T24] usb 3-1: config 0 descriptor?? [ 666.408094][T11797] usb 4-1: Using ep0 maxpacket: 32 [ 666.444241][ T24] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 666.518224][T11797] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 666.536911][ T5893] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 666.600017][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 666.655815][ T5893] usb 5-1: no configurations [ 666.693774][ T5893] usb 5-1: can't read configurations, error -22 [ 666.718089][ T5893] usb usb5-port1: unable to enumerate USB device [ 666.745571][T11797] usb 4-1: New USB device found, idVendor=2040, idProduct=4901, bcdDevice=47.77 [ 666.762766][T11797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.764498][T13206] tipc: Started in network mode [ 666.781795][T11797] usb 4-1: Product: syz [ 666.790110][T13206] tipc: Node identity 92762e23a0a9, cluster identity 4711 [ 666.799340][T13206] tipc: Enabled bearer , priority 0 [ 666.807426][T11797] usb 4-1: Manufacturer: syz [ 666.818902][T11797] usb 4-1: SerialNumber: syz [ 666.825299][T13206] syzkaller0: entered promiscuous mode [ 666.833512][T13206] syzkaller0: entered allmulticast mode [ 666.851090][T13206] syzkaller0: MTU too low for tipc bearer [ 666.857427][T13206] tipc: Disabling bearer [ 666.857448][T11797] usb 4-1: config 0 descriptor?? [ 666.894148][T11797] hdpvr 4-1:0.0: Could not find bulk-in endpoint [ 666.895756][T13208] FAULT_INJECTION: forcing a failure. [ 666.895756][T13208] name failslab, interval 1, probability 0, space 0, times 0 [ 666.904890][T11797] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 666.932849][T13208] CPU: 1 UID: 0 PID: 13208 Comm: syz.1.2102 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 666.932877][T13208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 666.932894][T13208] Call Trace: [ 666.932904][T13208] [ 666.932913][T13208] dump_stack_lvl+0x241/0x360 [ 666.932947][T13208] ? __pfx_dump_stack_lvl+0x10/0x10 [ 666.932974][T13208] ? __pfx__printk+0x10/0x10 [ 666.933005][T13208] ? __pfx___might_resched+0x10/0x10 [ 666.933032][T13208] should_fail_ex+0x424/0x570 [ 666.933059][T13208] should_failslab+0xac/0x100 [ 666.933087][T13208] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 666.933115][T13208] ? __alloc_skb+0x1c2/0x480 [ 666.933134][T13208] __alloc_skb+0x1c2/0x480 [ 666.933149][T13208] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 666.933175][T13208] ? __pfx___alloc_skb+0x10/0x10 [ 666.933214][T13208] pfkey_sendmsg+0xdbe/0x1140 [ 666.933250][T13208] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 666.933289][T13208] ? __pfx_aa_sk_perm+0x10/0x10 [ 666.933317][T13208] ? __import_iovec+0x585/0x830 [ 666.933338][T13208] ? aa_sock_msg_perm+0x91/0x160 [ 666.933369][T13208] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 666.933386][T13208] __sock_sendmsg+0x221/0x270 [ 666.933413][T13208] ____sys_sendmsg+0x523/0x860 [ 666.933442][T13208] ? __pfx_____sys_sendmsg+0x10/0x10 [ 666.933480][T13208] __sys_sendmsg+0x271/0x360 [ 666.933507][T13208] ? __pfx___sys_sendmsg+0x10/0x10 [ 666.933576][T13208] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 666.933597][T13208] ? lockdep_hardirqs_on+0x9d/0x150 [ 666.933621][T13208] __do_fast_syscall_32+0xb4/0x110 [ 666.933642][T13208] ? exc_page_fault+0x5f8/0x920 [ 666.933667][T13208] do_fast_syscall_32+0x34/0x80 [ 666.933689][T13208] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 666.933712][T13208] RIP: 0023:0xf7f37579 [ 666.933730][T13208] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 666.933746][T13208] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 666.933787][T13208] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 666.933801][T13208] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 666.933812][T13208] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 666.933823][T13208] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 666.933834][T13208] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 666.933863][T13208] [ 667.506550][ T5893] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 667.514765][ T9613] usb 3-1: Failed to submit usb control message: -110 [ 667.534316][T13216] veth1_macvtap: left promiscuous mode [ 667.542381][T13216] macsec0: entered promiscuous mode [ 667.548761][ T9613] usb 3-1: unable to send the bmi data to the device: -110 [ 667.569002][ T9613] usb 3-1: unable to get target info from device [ 667.577034][T13216] veth1_macvtap: entered promiscuous mode [ 667.583106][ T9613] usb 3-1: could not get target info (-110) [ 667.593299][T13216] macsec0: left promiscuous mode [ 667.602493][ T9613] usb 3-1: could not probe fw (-110) [ 667.680887][ T5893] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 667.692806][ T5893] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 667.704834][ T5893] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 667.717624][ T5893] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 667.730912][ T5893] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 667.755770][ T5893] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 667.770332][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 667.779547][ T5893] usb 2-1: Product: syz [ 667.783812][ T5893] usb 2-1: Manufacturer: syz [ 667.808960][ T5893] cdc_wdm 2-1:1.0: skipping garbage [ 667.814670][ T5893] cdc_wdm 2-1:1.0: skipping garbage [ 667.824511][ T5893] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 667.833978][ T5893] cdc_wdm 2-1:1.0: Unknown control protocol [ 668.221167][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -EPIPE [ 668.295025][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 668.301793][ C0] wdm_int_callback: 973 callbacks suppressed [ 668.301814][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 668.306556][T11797] usb 2-1: USB disconnect, device number 97 [ 668.308001][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 668.468549][ T5844] usb 3-1: USB disconnect, device number 87 [ 668.623924][T11797] usb 4-1: USB disconnect, device number 118 [ 669.155014][T13239] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2112'. [ 669.266577][T11797] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 669.421965][T11797] usb 1-1: Using ep0 maxpacket: 16 [ 669.455313][T11797] usb 1-1: unable to get BOS descriptor or descriptor too short [ 669.497824][T11797] usb 1-1: config 5 has an invalid interface number: 211 but max is 0 [ 669.526339][T11797] usb 1-1: config 5 has no interface number 0 [ 669.532649][T11797] usb 1-1: config 5 interface 211 has no altsetting 0 [ 669.554562][T11797] usb 1-1: New USB device found, idVendor=061d, idProduct=c160, bcdDevice=b8.74 [ 669.568908][ T5844] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 669.579035][T11797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.593052][T11797] usb 1-1: Product: syz [ 669.600028][T11797] usb 1-1: Manufacturer: syz [ 669.604936][T11797] usb 1-1: SerialNumber: syz [ 669.630122][T13239] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 669.641196][T13239] bond_slave_0: left allmulticast mode [ 669.662308][T13239] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 669.673841][T13239] bond_slave_1: left allmulticast mode [ 669.684684][T13239] bond0 (unregistering): Released all slaves [ 669.696644][T13246] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2114'. [ 669.746538][ T5844] usb 2-1: Using ep0 maxpacket: 8 [ 669.762494][ T5844] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 669.792624][ T5844] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 669.846611][ T5844] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 669.868071][ T5844] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 669.880686][ T5844] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 669.894875][ T5844] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 669.933933][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.964396][T13250] FAULT_INJECTION: forcing a failure. [ 669.964396][T13250] name failslab, interval 1, probability 0, space 0, times 0 [ 670.018529][T13250] CPU: 0 UID: 0 PID: 13250 Comm: syz.3.2115 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 670.018559][T13250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 670.018570][T13250] Call Trace: [ 670.018577][T13250] [ 670.018584][T13250] dump_stack_lvl+0x241/0x360 [ 670.018613][T13250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 670.018638][T13250] ? __pfx__printk+0x10/0x10 [ 670.018667][T13250] ? __pfx___might_resched+0x10/0x10 [ 670.018688][T13250] should_fail_ex+0x424/0x570 [ 670.018709][T13250] should_failslab+0xac/0x100 [ 670.018731][T13250] __kmalloc_noprof+0xdf/0x4d0 [ 670.018749][T13250] ? tomoyo_realpath_from_path+0xc2/0x5e0 [ 670.018770][T13250] ? tomoyo_realpath_from_path+0xcf/0x5e0 [ 670.018801][T13250] tomoyo_realpath_from_path+0xcf/0x5e0 [ 670.018834][T13250] tomoyo_path_number_perm+0x245/0x790 [ 670.018852][T13250] ? __lock_acquire+0xad5/0xd80 [ 670.018869][T13250] ? tomoyo_path_number_perm+0x215/0x790 [ 670.018889][T13250] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 670.018950][T13250] ? __fget_files+0x2a/0x420 [ 670.018964][T13250] ? __fget_files+0x2a/0x420 [ 670.018980][T13250] ? __fget_files+0x2a/0x420 [ 670.018998][T13250] security_file_ioctl_compat+0xc6/0x2a0 [ 670.019018][T13250] __se_compat_sys_ioctl+0xd8/0xc30 [ 670.019036][T13250] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 670.019056][T13250] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 670.019078][T13250] ? __fget_files+0x2a/0x420 [ 670.019099][T13250] ? fput+0x9b/0xd0 [ 670.019113][T13250] ? ksys_write+0x275/0x2d0 [ 670.019136][T13250] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 670.019160][T13250] ? lockdep_hardirqs_on+0x9d/0x150 [ 670.019180][T13250] __do_fast_syscall_32+0xb4/0x110 [ 670.019197][T13250] ? exc_page_fault+0x5f8/0x920 [ 670.019223][T13250] do_fast_syscall_32+0x34/0x80 [ 670.019242][T13250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 670.019261][T13250] RIP: 0023:0xf742d579 [ 670.019274][T13250] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 670.019288][T13250] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 670.019305][T13250] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000008138ae83 [ 670.019316][T13250] RDX: 0000000080000340 RSI: 0000000000000000 RDI: 0000000000000000 [ 670.019325][T13250] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 670.019334][T13250] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 670.019344][T13250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 670.019373][T13250] [ 670.019383][T13250] ERROR: Out of memory at tomoyo_realpath_from_path. [ 670.170542][ T5844] usb 2-1: usb_control_msg returned -32 [ 670.322636][ T5844] usbtmc 2-1:16.0: can't read capabilities [ 670.371867][T13254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2117'. [ 670.611477][T13261] usbtmc 2-1:16.0: control status returned 0 [ 670.745379][T13265] veth1_macvtap: left promiscuous mode [ 670.751244][T13265] macsec0: entered promiscuous mode [ 670.785729][T13265] veth1_macvtap: entered promiscuous mode [ 670.796882][T13265] macsec0: left promiscuous mode [ 670.914334][T13270] FAULT_INJECTION: forcing a failure. [ 670.914334][T13270] name failslab, interval 1, probability 0, space 0, times 0 [ 670.930711][T13270] CPU: 1 UID: 0 PID: 13270 Comm: syz.3.2123 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 670.930740][T13270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 670.930752][T13270] Call Trace: [ 670.930759][T13270] [ 670.930766][T13270] dump_stack_lvl+0x241/0x360 [ 670.930790][T13270] ? __pfx_dump_stack_lvl+0x10/0x10 [ 670.930806][T13270] ? __pfx__printk+0x10/0x10 [ 670.930831][T13270] ? __pfx___might_resched+0x10/0x10 [ 670.930849][T13270] should_fail_ex+0x424/0x570 [ 670.930864][T13270] should_failslab+0xac/0x100 [ 670.930882][T13270] __kmalloc_noprof+0xdf/0x4d0 [ 670.930897][T13270] ? drm_atomic_state_init+0xff/0x2f0 [ 670.930913][T13270] drm_atomic_state_init+0xff/0x2f0 [ 670.930928][T13270] drm_atomic_state_alloc+0xb9/0x100 [ 670.930942][T13270] drm_mode_atomic_ioctl+0x456/0x1420 [ 670.930959][T13270] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 670.930981][T13270] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 670.931011][T13270] ? do_raw_spin_unlock+0x13c/0x8b0 [ 670.931031][T13270] ? _raw_spin_unlock+0x28/0x50 [ 670.931045][T13270] drm_ioctl_kernel+0x34e/0x450 [ 670.931064][T13270] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 670.931082][T13270] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 670.931104][T13270] drm_ioctl+0x687/0xbb0 [ 670.931120][T13270] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 670.931141][T13270] ? __pfx_drm_ioctl+0x10/0x10 [ 670.931165][T13270] ? __fget_files+0x2a/0x420 [ 670.931175][T13270] ? drm_compat_ioctl+0xab/0x340 [ 670.931192][T13270] __se_compat_sys_ioctl+0x50e/0xc30 [ 670.931208][T13270] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 670.931222][T13270] ? __fget_files+0x2a/0x420 [ 670.931236][T13270] ? fput+0x9b/0xd0 [ 670.931247][T13270] ? ksys_write+0x275/0x2d0 [ 670.931265][T13270] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 670.931278][T13270] ? lockdep_hardirqs_on+0x9d/0x150 [ 670.931292][T13270] __do_fast_syscall_32+0xb4/0x110 [ 670.931306][T13270] ? exc_page_fault+0x5f8/0x920 [ 670.931321][T13270] do_fast_syscall_32+0x34/0x80 [ 670.931335][T13270] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 670.931349][T13270] RIP: 0023:0xf742d579 [ 670.931360][T13270] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 670.931371][T13270] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 670.931386][T13270] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c03864bc [ 670.931394][T13270] RDX: 0000000080000380 RSI: 0000000000000000 RDI: 0000000000000000 [ 670.931402][T13270] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 670.931409][T13270] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 670.931416][T13270] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 670.931433][T13270] [ 671.868666][T11797] quatech2 1-1:5.211: Quatech 2nd gen USB to Serial Driver converter detected [ 671.920098][T11797] usb 1-1: qt2_attach - failed to power on unit: -71 [ 671.947091][T11797] quatech2 1-1:5.211: probe with driver quatech2 failed with error -71 [ 671.973012][T11797] usb 1-1: USB disconnect, device number 102 [ 672.076791][ T5893] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 672.290576][ T979] usb 2-1: USB disconnect, device number 98 [ 672.375073][T13282] netlink: 62 bytes leftover after parsing attributes in process `syz.1.2127'. [ 672.384690][T13282] FAULT_INJECTION: forcing a failure. [ 672.384690][T13282] name failslab, interval 1, probability 0, space 0, times 0 [ 672.400204][T13282] CPU: 0 UID: 0 PID: 13282 Comm: syz.1.2127 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 672.400233][T13282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 672.400246][T13282] Call Trace: [ 672.400255][T13282] [ 672.400264][T13282] dump_stack_lvl+0x241/0x360 [ 672.400306][T13282] ? __pfx_dump_stack_lvl+0x10/0x10 [ 672.400333][T13282] ? __pfx__printk+0x10/0x10 [ 672.400365][T13282] ? __pfx___might_resched+0x10/0x10 [ 672.400392][T13282] should_fail_ex+0x424/0x570 [ 672.400419][T13282] should_failslab+0xac/0x100 [ 672.400448][T13282] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 672.400474][T13282] ? __alloc_skb+0x1c2/0x480 [ 672.400489][T13282] ? __dev_queue_xmit+0x1780/0x3f60 [ 672.400513][T13282] __alloc_skb+0x1c2/0x480 [ 672.400532][T13282] ? __do_fast_syscall_32+0xb4/0x110 [ 672.400561][T13282] ? __pfx___alloc_skb+0x10/0x10 [ 672.400584][T13282] ? netlink_ack_tlv_len+0x6e/0x200 [ 672.400613][T13282] netlink_ack+0x147/0xa70 [ 672.400648][T13282] ? __pfx_nl80211_channel_switch+0x10/0x10 [ 672.400696][T13282] netlink_rcv_skb+0x296/0x480 [ 672.400723][T13282] ? __pfx_genl_rcv_msg+0x10/0x10 [ 672.400746][T13282] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 672.400796][T13282] ? netlink_deliver_tap+0x2e/0x1b0 [ 672.400829][T13282] genl_rcv+0x28/0x40 [ 672.400855][T13282] netlink_unicast+0x7f8/0x9a0 [ 672.400889][T13282] ? __pfx_netlink_unicast+0x10/0x10 [ 672.400914][T13282] ? skb_put+0x114/0x1f0 [ 672.400939][T13282] netlink_sendmsg+0x8c3/0xcd0 [ 672.400978][T13282] ? __pfx_netlink_sendmsg+0x10/0x10 [ 672.401009][T13282] ? __import_iovec+0x585/0x830 [ 672.401034][T13282] ? aa_sock_msg_perm+0x91/0x160 [ 672.401066][T13282] ? __pfx_netlink_sendmsg+0x10/0x10 [ 672.401090][T13282] __sock_sendmsg+0x221/0x270 [ 672.401118][T13282] ____sys_sendmsg+0x523/0x860 [ 672.401150][T13282] ? __pfx_____sys_sendmsg+0x10/0x10 [ 672.401187][T13282] __sys_sendmsg+0x271/0x360 [ 672.401215][T13282] ? __pfx___sys_sendmsg+0x10/0x10 [ 672.401291][T13282] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 672.401314][T13282] ? lockdep_hardirqs_on+0x9d/0x150 [ 672.401340][T13282] __do_fast_syscall_32+0xb4/0x110 [ 672.401362][T13282] ? exc_page_fault+0x5f8/0x920 [ 672.401389][T13282] do_fast_syscall_32+0x34/0x80 [ 672.401411][T13282] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 672.401433][T13282] RIP: 0023:0xf7f37579 [ 672.401452][T13282] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 672.401467][T13282] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 672.401490][T13282] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 672.401504][T13282] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 672.401516][T13282] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 672.401528][T13282] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 672.401540][T13282] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 672.401571][T13282] [ 672.706644][ C0] vkms_vblank_simulate: vblank timer overrun [ 673.090017][T13288] sg_write: data in/out 131840/124 bytes for SCSI command 0x52-- guessing data in; [ 673.090017][T13288] program syz.0.2130 not setting count and/or reply_len properly [ 673.164556][T13289] @: renamed from vlan0 (while UP) [ 673.207737][T11797] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 673.271593][ T5893] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 673.288327][T13291] loop2: detected capacity change from 0 to 7 [ 673.300556][T13291] Dev loop2: unable to read RDB block 7 [ 673.319947][T13291] loop2: unable to read partition table [ 673.340031][T13291] loop2: partition table beyond EOD, truncated [ 673.351608][T13291] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 673.367729][T11797] usb 5-1: Using ep0 maxpacket: 16 [ 673.381118][T11797] usb 5-1: config 8 has an invalid interface number: 206 but max is 0 [ 673.396560][ T5893] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 673.405229][T11797] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 673.440560][T11797] usb 5-1: config 8 has no interface number 0 [ 673.456648][ T24] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 673.474604][T11797] usb 5-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 673.495445][ T5893] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 673.515778][T11797] usb 5-1: config 8 interface 206 has no altsetting 0 [ 673.539747][ T5893] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.541831][T11797] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 673.574471][T11797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.613790][T11797] usb 5-1: Product: syz [ 673.623980][T11797] usb 5-1: Manufacturer: syz [ 673.638782][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 673.651244][ T24] usb 3-1: config 8 has an invalid interface number: 206 but max is 0 [ 673.666267][T11797] usb 5-1: SerialNumber: syz [ 673.682781][ T24] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 673.698392][ T24] usb 3-1: config 8 has no interface number 0 [ 673.708964][ T24] usb 3-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 673.724020][ T24] usb 3-1: config 8 interface 206 has no altsetting 0 [ 673.736654][ T24] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 673.755809][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.765740][ T24] usb 3-1: Product: syz [ 673.775893][ T24] usb 3-1: Manufacturer: syz [ 673.781233][ T24] usb 3-1: SerialNumber: syz [ 673.885546][T13302] veth1_macvtap: left promiscuous mode [ 673.894415][T13302] macsec0: entered promiscuous mode [ 673.912917][T13302] veth1_macvtap: entered promiscuous mode [ 673.921119][T13302] macsec0: left promiscuous mode [ 673.926785][ T976] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 673.986765][T11797] garmin_gps 5-1:8.206: Garmin GPS usb/tty converter detected [ 674.033320][T11797] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 674.045126][ T24] garmin_gps 3-1:8.206: Garmin GPS usb/tty converter detected [ 674.059965][T11797] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 674.081611][ T24] garmin_gps ttyUSB1: failed to submit interrupt urb: -22 [ 674.116667][ T976] usb 2-1: Using ep0 maxpacket: 32 [ 674.122145][ T24] garmin_gps ttyUSB1: probe with driver garmin_gps failed with error -22 [ 674.135296][ T976] usb 2-1: config 1 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 24716, setting to 1024 [ 674.171011][T11797] usb 5-1: USB disconnect, device number 86 [ 674.212236][T11797] garmin_gps 5-1:8.206: device disconnected [ 674.221489][ T24] usb 3-1: USB disconnect, device number 88 [ 674.228705][ T976] usb 2-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 674.275304][ T24] garmin_gps 3-1:8.206: device disconnected [ 674.320872][ T976] usb 2-1: config 1 interface 0 has no altsetting 0 [ 674.341611][ T976] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.40 [ 674.353681][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.393898][ T976] usb 2-1: Product: ш [ 674.410445][ T976] usb 2-1: Manufacturer: 㰁 [ 674.426928][ T976] usb 2-1: SerialNumber: 埀 [ 674.996366][ T5893] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 675.096790][ T24] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 675.166677][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 675.184474][T13311] netlink: 62 bytes leftover after parsing attributes in process `syz.0.2138'. [ 675.196579][ T5893] usb 5-1: unable to get BOS descriptor or descriptor too short [ 675.221432][ T5893] usb 5-1: config 5 has an invalid interface number: 211 but max is 0 [ 675.239360][ T5893] usb 5-1: config 5 has no interface number 0 [ 675.252982][ T5893] usb 5-1: config 5 interface 211 has no altsetting 0 [ 675.271000][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 675.271667][ T5893] usb 5-1: New USB device found, idVendor=061d, idProduct=c160, bcdDevice=b8.74 [ 675.277292][ T976] usbhid 2-1:1.0: can't add hid device: -71 [ 675.291436][ T5893] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.317940][ T5893] usb 5-1: Product: syz [ 675.322262][ T976] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 675.322451][ T24] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 675.343405][T13313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2139'. [ 675.353090][ T5893] usb 5-1: Manufacturer: syz [ 675.357382][ T976] usb 2-1: USB disconnect, device number 99 [ 675.362928][ T5893] usb 5-1: SerialNumber: syz [ 675.374191][ T24] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 675.384544][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 675.396945][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 675.408848][ T24] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 675.425058][ T24] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 675.447581][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.680352][ T24] usb 3-1: usb_control_msg returned -32 [ 675.695804][ T24] usbtmc 3-1:16.0: can't read capabilities [ 675.696491][ T979] usb 4-1: USB disconnect, device number 119 [ 675.886331][ T5894] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 675.926361][T13320] netlink: 'syz.3.2141': attribute type 10 has an invalid length. [ 675.938069][T13320] bond0: (slave wlan1): Opening slave failed [ 676.026363][ T5894] usb 1-1: device descriptor read/64, error -71 [ 676.053534][T13326] usbtmc 3-1:16.0: control status returned 0 [ 676.286446][ T5894] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 676.416607][ T5894] usb 1-1: device descriptor read/64, error -71 [ 676.537587][ T5894] usb usb1-port1: attempt power cycle [ 676.876728][ T5894] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 676.917614][ T5894] usb 1-1: device descriptor read/8, error -71 [ 677.076344][ T976] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 677.166495][ T5894] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 677.174690][T10968] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 677.197738][ T5894] usb 1-1: device descriptor read/8, error -71 [ 677.227477][ T976] usb 2-1: Using ep0 maxpacket: 16 [ 677.234776][ T976] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 677.246439][ T976] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 677.260659][ T976] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 677.272854][ T976] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 677.288503][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.298377][ T976] usb 2-1: Product: syz [ 677.302677][ T976] usb 2-1: Manufacturer: syz [ 677.310025][ T976] usb 2-1: SerialNumber: syz [ 677.317834][ T5894] usb usb1-port1: unable to enumerate USB device [ 677.346809][T10968] usb 4-1: Using ep0 maxpacket: 32 [ 677.354402][T10968] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 677.369365][T10968] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 677.378966][T10968] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 677.389360][T10968] usb 4-1: Product: syz [ 677.393786][T10968] usb 4-1: Manufacturer: syz [ 677.398876][T10968] usb 4-1: SerialNumber: syz [ 677.408038][T10968] usb 4-1: config 0 descriptor?? [ 677.414435][T13331] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 677.634365][T13331] usbtmc 3-1:16.0: send_request_dev_dep_msg_in returned -90 [ 677.670486][ T5893] quatech2 5-1:5.211: Quatech 2nd gen USB to Serial Driver converter detected [ 677.691116][ T5893] usb 5-1: qt2_attach - failed to power on unit: -71 [ 677.700315][ T5893] quatech2 5-1:5.211: probe with driver quatech2 failed with error -71 [ 677.725217][ T5893] usb 5-1: USB disconnect, device number 87 [ 677.744521][ T976] usb 2-1: 0:2 : does not exist [ 677.841088][ T5894] usb 3-1: USB disconnect, device number 89 [ 678.119540][ T5894] usb 4-1: USB disconnect, device number 120 [ 678.197737][ T5893] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 678.365677][T13343] [ 678.368089][T13343] ====================================================== [ 678.375314][T13343] WARNING: possible circular locking dependency detected [ 678.382625][T13343] 6.15.0-rc1-syzkaller #0 Not tainted [ 678.388026][T13343] ------------------------------------------------------ [ 678.395160][T13343] syz.2.2150/13343 is trying to acquire lock: [ 678.401265][T13343] ffffffff900fd388 (rtnl_mutex){+.+.}-{4:4}, at: do_ip_getsockopt+0x11ae/0x2ba0 [ 678.410373][T13343] [ 678.410373][T13343] but task is already holding lock: [ 678.417774][T13343] ffff888029337220 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_getsockopt+0x131/0x400 [ 678.428012][T13343] [ 678.428012][T13343] which lock already depends on the new lock. [ 678.428012][T13343] [ 678.438443][T13343] [ 678.438443][T13343] the existing dependency chain (in reverse order) is: [ 678.447776][T13343] [ 678.447776][T13343] -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}: [ 678.456428][T13343] lock_acquire+0x116/0x2f0 [ 678.461670][T13343] __mutex_lock+0x1a5/0x10c0 [ 678.466833][T13343] smc_switch_to_fallback+0x35/0xda0 [ 678.472841][T13343] smc_sendmsg+0x11f/0x530 [ 678.477882][T13343] __sock_sendmsg+0x221/0x270 [ 678.483091][T13343] __sys_sendto+0x365/0x4c0 [ 678.488122][T13343] __ia32_sys_sendto+0xdd/0x100 [ 678.493524][T13343] __do_fast_syscall_32+0xb4/0x110 [ 678.499164][T13343] do_fast_syscall_32+0x34/0x80 [ 678.504583][T13343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 678.511476][T13343] [ 678.511476][T13343] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [ 678.519142][T13343] lock_acquire+0x116/0x2f0 [ 678.524283][T13343] lock_sock_nested+0x48/0x100 [ 678.529661][T13343] do_ip_setsockopt+0x17e9/0x39c0 [ 678.535315][T13343] ip_setsockopt+0x63/0x100 [ 678.540372][T13343] do_sock_setsockopt+0x3b1/0x710 [ 678.546033][T13343] __ia32_sys_setsockopt+0x1f2/0x280 [ 678.551851][T13343] __do_fast_syscall_32+0xb4/0x110 [ 678.557487][T13343] do_fast_syscall_32+0x34/0x80 [ 678.562863][T13343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 678.569980][T13343] [ 678.569980][T13343] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 678.577324][T13343] validate_chain+0xa69/0x24e0 [ 678.582893][T13343] __lock_acquire+0xad5/0xd80 [ 678.588096][T13343] lock_acquire+0x116/0x2f0 [ 678.593209][T13343] __mutex_lock+0x1a5/0x10c0 [ 678.598320][T13343] do_ip_getsockopt+0x11ae/0x2ba0 [ 678.603907][T13343] ip_getsockopt+0xef/0x2e0 [ 678.608955][T13343] tcp_getsockopt+0x16f/0x1d0 [ 678.614195][T13343] smc_getsockopt+0x1c6/0x400 [ 678.619416][T13343] do_sock_getsockopt+0x391/0x740 [ 678.624974][T13343] __ia32_sys_getsockopt+0x2a1/0x370 [ 678.630794][T13343] __do_fast_syscall_32+0xb4/0x110 [ 678.636554][T13343] do_fast_syscall_32+0x34/0x80 [ 678.641931][T13343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 678.648817][T13343] [ 678.648817][T13343] other info that might help us debug this: [ 678.648817][T13343] [ 678.659244][T13343] Chain exists of: [ 678.659244][T13343] rtnl_mutex --> sk_lock-AF_INET --> &smc->clcsock_release_lock [ 678.659244][T13343] [ 678.673026][T13343] Possible unsafe locking scenario: [ 678.673026][T13343] [ 678.680583][T13343] CPU0 CPU1 [ 678.685952][T13343] ---- ---- [ 678.691586][T13343] lock(&smc->clcsock_release_lock); [ 678.697003][T13343] lock(sk_lock-AF_INET); [ 678.703952][T13343] lock(&smc->clcsock_release_lock); [ 678.711880][T13343] lock(rtnl_mutex); [ 678.715929][T13343] [ 678.715929][T13343] *** DEADLOCK *** [ 678.715929][T13343] [ 678.724164][T13343] 1 lock held by syz.2.2150/13343: [ 678.729275][T13343] #0: ffff888029337220 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_getsockopt+0x131/0x400 [ 678.739913][T13343] [ 678.739913][T13343] stack backtrace: [ 678.745811][T13343] CPU: 0 UID: 0 PID: 13343 Comm: syz.2.2150 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) [ 678.745830][T13343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 678.745840][T13343] Call Trace: [ 678.745850][T13343] [ 678.745858][T13343] dump_stack_lvl+0x241/0x360 [ 678.745886][T13343] ? __pfx_dump_stack_lvl+0x10/0x10 [ 678.745907][T13343] ? __pfx__printk+0x10/0x10 [ 678.745929][T13343] ? print_lock+0x171/0x1a0 [ 678.745947][T13343] print_circular_bug+0x2e1/0x300 [ 678.745968][T13343] check_noncircular+0x142/0x160 [ 678.745989][T13343] validate_chain+0xa69/0x24e0 [ 678.746019][T13343] __lock_acquire+0xad5/0xd80 [ 678.746037][T13343] lock_acquire+0x116/0x2f0 [ 678.746058][T13343] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 678.746079][T13343] __mutex_lock+0x1a5/0x10c0 [ 678.746095][T13343] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 678.746112][T13343] ? __lock_acquire+0xad5/0xd80 [ 678.746128][T13343] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 678.746147][T13343] ? __pfx___mutex_lock+0x10/0x10 [ 678.746170][T13343] do_ip_getsockopt+0x11ae/0x2ba0 [ 678.746193][T13343] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 678.746216][T13343] ? look_up_lock_class+0x7b/0x170 [ 678.746233][T13343] ? register_lock_class+0x54/0x330 [ 678.746249][T13343] ? __lock_acquire+0xad5/0xd80 [ 678.746264][T13343] ? __mutex_trylock_common+0x184/0x2e0 [ 678.746286][T13343] ? __pfx___mutex_trylock_common+0x10/0x10 [ 678.746308][T13343] ip_getsockopt+0xef/0x2e0 [ 678.746326][T13343] ? __pfx_ip_getsockopt+0x10/0x10 [ 678.746345][T13343] ? smc_getsockopt+0x131/0x400 [ 678.746362][T13343] tcp_getsockopt+0x16f/0x1d0 [ 678.746382][T13343] ? __pfx_tcp_getsockopt+0x10/0x10 [ 678.746402][T13343] ? aa_sk_perm+0x96f/0xac0 [ 678.746421][T13343] ? sock_common_getsockopt+0x2e/0xb0 [ 678.746443][T13343] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 678.746462][T13343] smc_getsockopt+0x1c6/0x400 [ 678.746479][T13343] ? __pfx_smc_getsockopt+0x10/0x10 [ 678.746494][T13343] ? aa_sock_opt_perm+0x79/0x120 [ 678.746514][T13343] ? __pfx_smc_getsockopt+0x10/0x10 [ 678.746530][T13343] do_sock_getsockopt+0x391/0x740 [ 678.746546][T13343] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 678.746563][T13343] ? __fget_files+0x2a/0x420 [ 678.746578][T13343] ? __fget_files+0x39d/0x420 [ 678.746591][T13343] ? __fget_files+0x2a/0x420 [ 678.746605][T13343] __ia32_sys_getsockopt+0x2a1/0x370 [ 678.746623][T13343] ? __pfx___ia32_sys_getsockopt+0x10/0x10 [ 678.746640][T13343] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 678.746660][T13343] ? lockdep_hardirqs_on+0x9d/0x150 [ 678.746677][T13343] __do_fast_syscall_32+0xb4/0x110 [ 678.746696][T13343] ? exc_page_fault+0x5f8/0x920 [ 678.746715][T13343] do_fast_syscall_32+0x34/0x80 [ 678.746732][T13343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 678.746750][T13343] RIP: 0023:0xf748d579 [ 678.746764][T13343] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 678.746777][T13343] RSP: 002b:00000000f511655c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 678.746794][T13343] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 678.746806][T13343] RDX: 0000000000000029 RSI: 0000000000000000 RDI: 00000000800000c0 [ 678.746816][T13343] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 678.746825][T13343] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 678.746836][T13343] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 678.746852][T13343] [ 679.118859][ T5893] usb 5-1: Using ep0 maxpacket: 16 [ 679.237859][ T5893] usb 5-1: config 8 has an invalid interface number: 206 but max is 0 [ 679.246375][ T5893] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 679.256612][ T5893] usb 5-1: config 8 has no interface number 0 [ 679.262764][ T5893] usb 5-1: config 8 interface 206 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 679.276374][ T5893] usb 5-1: config 8 interface 206 has no altsetting 0 [ 679.286879][ T5893] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 679.295969][ T5893] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.304348][ T5893] usb 5-1: Product: syz [ 679.308711][ T5893] usb 5-1: Manufacturer: syz [ 679.313336][ T5893] usb 5-1: SerialNumber: syz [ 679.349174][ T976] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 679.378855][ T976] usb 2-1: USB disconnect, device number 100 [ 679.526589][ T5893] garmin_gps 5-1:8.206: Garmin GPS usb/tty converter detected [ 679.534699][ T5893] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 679.544280][ T5893] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 679.555054][ T5893] usb 5-1: USB disconnect, device number 88 [ 679.568458][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 679.585294][ T5893] garmin_gps 5-1:8.206: device disconnected [ 686.148402][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.154780][ T1300] ieee802154 phy1 wpan1: encryption failed: -22