last executing test programs: 13.145507449s ago: executing program 2 (id=916): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018460000feffffff00000000002b0d0fb500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0x7, 0x9}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r4, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) write$9p(r4, &(0x7f0000000100)="d52dbd896e79", 0x6) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r5, 0x0, 0x30, 0x4}, 0x14) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r4, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xfffffffffffffd6a, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, r1, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4709a44386780935}, 0x20000005) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0x0, 0xdc0}, 0xc) socket$inet6(0xa, 0x2, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r0) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x44, r8, 0x10, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x60}, @NL80211_ATTR_SSID={0x10, 0x34, @random="542a254ce5b934f5e2e79fb4"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x44}, 0x1, 0x0, 0x0, 0x419bc726bb3c94bf}, 0x20001000) r9 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000000000407d1e9c3100000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io(r9, &(0x7f0000000400)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) clock_adjtime(0x0, &(0x7f0000000600)={0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4, 0x9, 0x0, 0x0, 0x1}) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x3c1, 0x3, 0x310, 0x130, 0xc8, 0x8, 0x0, 0x5803, 0x240, 0x2e8, 0x2e8, 0x240, 0x2e8, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, [0x0, 0xffffff00], [0xffffff00, 0xff], 'erspan0\x00', 'geneve1\x00', {0xff}, {0xff}}, 0x0, 0x108, 0x130, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x2, 0x0, 0xf, 0x17f, 0x8, {0x5}}}, @common=@inet=@socket3={{0x28}, 0x6}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x4, 0x8}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xfffffffc, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x370) 10.381566044s ago: executing program 2 (id=928): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000040)={0x4, 0x7, 0x4, 0xffff, 0x0, "008ef14ba278887cb0baba08431799317e6324"}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xe4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r7, &(0x7f00000002c0)={0x130, 0x0, r8, {0x7, 0xc, 0x0, '\x00', {0x86, 0x4af22, 0x6, 0x9, 0x0, r9, 0xa000, '\x00', 0x6, 0x8, 0xd60b, 0x80000000005, {0x4002008, 0xfffffff3}, {0x203d7f, 0x7, 0xc000000}, {0x4000100000000408, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r10, &(0x7f0000000000), 0x0, 0x24004001) ioctl$sock_SIOCSIFBR(r11, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x5, 0xc8}) io_submit(r5, 0x20000000000002b5, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 9.750064884s ago: executing program 1 (id=930): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000040)={0x4, 0x7, 0x4, 0xffff, 0x0, "008ef14ba278887cb0baba08431799317e6324"}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xe4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r5, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r5, &(0x7f00000002c0)={0x130, 0x0, r6, {0x7, 0xc, 0x0, '\x00', {0x86, 0x4af22, 0x6, 0x9, 0x0, r7, 0xa000, '\x00', 0x6, 0x8, 0xd60b, 0x80000000005, {0x4002008, 0xfffffff3}, {0x203d7f, 0x7, 0xc000000}, {0x4000100000000408, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000000000), 0x0, 0x24004001) ioctl$sock_SIOCSIFBR(r9, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x5, 0xc8}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 8.173340481s ago: executing program 2 (id=934): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r1, 0x0, 0x0) write$bt_hci(r1, &(0x7f0000000000)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "83f46d5c99cc"}}}, 0xb) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000340)={0x14, &(0x7f0000000100)={0x20, 0x24, 0xd4, {0xd4, 0x7777413cbd647fa7, "b9f6527d9cca2dde969d98cb9ac76bf65079dce010bb8bfeb3170b3a782047d36b12477ce68baed38a8c678facb2a203e011032f7a0831a160388a409225d3c3f7dd5b1718e888bc7725c8339bb941e0e2a3209d213f4f6ddefa1c333f2aecb0b9e366ae5dcc2831dfcf7eec40d55bbc710c18876b8e83ff6123c573c940788bb622a7b801851b543717e0e1e6324c8ea569a929d7f4dd36fb8df18ae6f9b2d8a6efc2819a8a3cb2deceb2dde244b769cdf2fb2106947d597b0c5a13a603266eaa9decfb515b69de77399c287b24881055b9"}}, &(0x7f0000000200)={0x0, 0x3, 0x8b, @string={0x8b, 0x3, "cb6261af36dfbce259f8235e700fcd92c1c756f1349873f151a73401c97d82f9403e8b610b577c2dfa0b236d0e96773414eda299e92693ed52751237c25d0e6608d20296182c87e4476bfc8535eab940b456d7944b6c4e88d35ecb54089cd088758c965fe309203fdf6aeb3587c9e8afa41ef576119cead1548faa48c829506ee026afa061f806d2a3"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000380)={0x40, 0x6, 0x9c, "d07648384c9651c891d3560e0c28440b4f2c48f3666257a70f89ea72b230fd0d2e430f20913554f77267598d259f11d7023d51857585bcf3656c61e08e38e51ba7bb7665592467b4e8816a672f9274c96569f28bdd0096f4b5408f150250e421b3bceb9ec0d611d7f0d2c1503481dabed8e049bd695d0881e396aa7c9bfceadd137f6f84da7454c15420ab04971ef7782f327201c8da922bc35aa93e"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000004c0)={0x20, 0x81, 0x2, "c3a9"}, &(0x7f0000000500)={0x20, 0x82, 0x2, "437f"}, &(0x7f0000000540)={0x20, 0x83, 0x1, '@'}, &(0x7f0000000580)={0x20, 0x84, 0x4, "7d0666d1"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "f0cf17"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r4, @ANYRES16=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 7.221007672s ago: executing program 1 (id=936): socketpair(0x28, 0x4, 0x200, &(0x7f0000000180)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xa0001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = io_uring_setup(0x8, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, 0x0, 0x7ffffffe) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000900)=[@in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x1c) sendto$inet6(r4, &(0x7f0000000a40), 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) r6 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/rt6_stats\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x75, 0x2, 0x2, 0x4002804c4, 0x9, 0x8000000000000000, 0x5, 0x0, 0x4, 0xefffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x284a93}) ioctl$KVM_RUN(r8, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 6.777886086s ago: executing program 1 (id=938): ioctl$XFS_IOC_SCRUB_METADATA(0xffffffffffffffff, 0xc040583c, 0x0) ioprio_set$pid(0x1, 0x0, 0x2000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102379, 0x18feb) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, 0x0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/27], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000019080)=0x30) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x121341) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "3f60eb8f2777c39a", "5985e81ad0d9585bc175cbecd3f55eb699e3070cc206f3ba527c85bde06fbf19", "bc5ec28f", "b200"}, 0x38) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) 5.434475904s ago: executing program 3 (id=943): futex_waitv(&(0x7f0000001080), 0x0, 0x0, &(0x7f0000000140)={0x0, 0x3938700}, 0xe5055063e7c7fdbf) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x65, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x64}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x0, 0x4, 0x19, 0x4, 0xa, @private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x8, 0x2, 0x9}}) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x9, 0x80000100008b}, 0x0) fanotify_init(0xf00, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x8000) r1 = syz_open_dev$MSR(&(0x7f0000000180), 0x29, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000180)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f00000003c0)={&(0x7f0000000240)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r2, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f0000000040)={&(0x7f00000002c0)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r4, 0xfbfbfbfb}) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, &(0x7f0000000380)={0x0, 0x1, &(0x7f0000000440)=[r4], &(0x7f0000000200), &(0x7f00000000c0)=[r5], &(0x7f0000000040), 0x0, 0x300}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_coalesce={0xf, 0x0, 0x0, 0x9, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x800007, 0x4, 0x5, 0x6, 0x0, 0x4, 0x4, 0x0, 0xfffffffc, 0xfffffffc}}) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 4.557649664s ago: executing program 2 (id=946): semop(0x0, &(0x7f0000000000)=[{0x0, 0xcf1, 0x800}, {0x2, 0xe7, 0x800}], 0x2) r0 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271000301f81005080b02000105200809040000000101"], 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="33daa7d13b6824eba6e541b13ed245c86d0ea0c8770249146d76f7be407c534764561025d2e192a00622afc5e3362faca6116a0ab9a65fce24b8e3bbfea9d7e44c7532af34e174ab8bc503c4151ab76ed3ba41a9b2e2f9907075c338976cd509a26268d96560832a5748372c5322cb2e5fe1b7431e00000000000000"]}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x40081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000000c0)=0xf9) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r7, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) recvmmsg(r8, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000009f00)=[{&(0x7f0000000340)=""/162, 0xa2}, {&(0x7f0000000400)=""/70, 0x46}, {&(0x7f00000000c0)=""/52, 0x34}, {&(0x7f00000004c0)=""/194, 0xc2}, {&(0x7f00000005c0)=""/159, 0x9f}, {&(0x7f0000000680)=""/169, 0xa9}, {&(0x7f0000000080)=""/60, 0x3c}, {&(0x7f0000007ec0)=""/4103, 0x1007}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000006d40)=""/211, 0xd3}, {&(0x7f0000008f00)=""/4096, 0x1000}], 0xb}, 0x3}], 0x1, 0x40010022, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) ioctl$BTRFS_IOC_LOGICAL_INO(r1, 0xc0389424, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) close(0x3) syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) 4.486065547s ago: executing program 1 (id=947): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(xeta)\x00'}, 0x58) 4.398085498s ago: executing program 0 (id=948): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) 4.293799675s ago: executing program 0 (id=949): socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) syz_emit_ethernet(0x5e, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000104000280600fe880000000000000000000000000001fe8000000000000000000000000000aa00004e22889632efe977fe4e41fdb65a647547231645128905574024c13bd9f7178052786152a452d759cdd4c4fc3731406e7981546afb", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a4000000907806c31d12d2b653e0c9d32072c19dd6ca814b7d7b0000"], 0x0) utimes(&(0x7f0000000000)='./file1\x00', 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4004040) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25fe880000000000000000000000000101ffffffff000000000000000000000000000000004e2400000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000021000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff000000000000000000000000000000000500000000000000000000000020000000000000000000000000000000000000010002020000000044000500e0000001000000000000000000000000000004d632"], 0xfc}, 0x1, 0x0, 0x0, 0x20080004}, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r2, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @remote}}}], 0x20}, 0x20002880) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0xb4, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa0, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) 4.293154104s ago: executing program 1 (id=950): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000040)={0x4, 0x7, 0x4, 0xffff, 0x0, "008ef14ba278887cb0baba08431799317e6324"}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xe4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r7, &(0x7f00000002c0)={0x130, 0x0, r8, {0x7, 0xc, 0x0, '\x00', {0x86, 0x4af22, 0x6, 0x9, 0x0, r9, 0xa000, '\x00', 0x6, 0x8, 0xd60b, 0x80000000005, {0x4002008, 0xfffffff3}, {0x203d7f, 0x7, 0xc000000}, {0x4000100000000408, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFBR(r10, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x5, 0xc8}) io_submit(r5, 0x20000000000002b5, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 4.224209742s ago: executing program 4 (id=951): openat$procfs(0xffffffffffffff9c, &(0x7f0000002d80)='/proc/cgroups\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$MRT6_TABLE(0xffffffffffffffff, 0x29, 0xcf, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = landlock_create_ruleset(0x0, 0x41, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x0) landlock_restrict_self(r3, 0x0) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000000880)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x5, 0x3a, 'usrjquota=\xb9\xc4\xd7A%S\n\x10i\xcf\x84\x93v\x02\xe4y}\xcbV\xbb\xc1\xd5\x06\v\xdc\xd8\\\xc5\xb3\ag\xa6u\xbe\xf4)\xae\xb6\xfe*\x9d?\xb2C\xf0<\xc9\x820M\x92Tzs\xba\xca\x9d\xad\x17\x1b\x84\xbc\xb3\xd8\xad\f\x17\xbe\x17\xb5}.H\x90\xc7\x0e\xb3y\xd0\xc3\xf0c\x04\xe6\f\x01\x00\x02\xfd_W\x9a\xa7\x81\xfcr\xe9B\x95\x13\x9f\x10\x1b5\xc0\xf9\xb5\xe1\x15Y\x9b$\xa43\xe7F>\xb7\xa1\xb7zw\xac\xc8\x12\x94\xa7\xe5\xcb\xc0g\x865\\\x9e\xca\x8e\xe2\t\xb7\b\x00\x00\x00\x00\x00\x00\x00i7b\xad\x14oVT\xcb\xea\xd3\xad\xa9\x16\xd5\xb2\xa0 \x13^\xf6>\xd4\x8bZzl\x88\xddn\xab\xd6\x12\x1f\x06', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xdc\xf2\xb5', 0x3a, './file2'}, 0x112) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 4.066620652s ago: executing program 3 (id=952): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000003feffff720a00fef8ffffff71a401fe000000002d030000000000001d400500000000004704000001ed00007203feff000000001d44000000000000db0a08fee10000007303fdff00000000b500f3ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x6, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000180)=@IORING_OP_SYMLINKAT={0x26, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000240)='./file0\x00'}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @private0, @mcast2, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x14}) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xffffffff, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f00000004c0)={0x2e, 0x15, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x1, 0xdc9, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff, 0x0, 0x1}}}, &(0x7f0000000540)) r11 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_mr_vif\x00') syz_io_uring_submit(r1, r5, r10, &(0x7f0000000080)=@IORING_OP_RECV_ZC={0x3a, 0x0, 0x24, r11, 0x0, 0x0, 0x20fd, 0x0, 0x1, {0x0, 0x0, 0xe}}) 3.904071291s ago: executing program 0 (id=953): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000040)={0x4, 0x7, 0x4, 0xffff, 0x0, "008ef14ba278887cb0baba08431799317e6324"}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xe4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r7, &(0x7f00000002c0)={0x130, 0x0, r8, {0x7, 0xc, 0x0, '\x00', {0x86, 0x4af22, 0x6, 0x9, 0x0, r9, 0xa000, '\x00', 0x6, 0x8, 0xd60b, 0x80000000005, {0x4002008, 0xfffffff3}, {0x203d7f, 0x7, 0xc000000}, {0x4000100000000408, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmmsg$unix(r10, &(0x7f0000000000), 0x0, 0x24004001) io_submit(r5, 0x20000000000002b5, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 3.533651157s ago: executing program 3 (id=954): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x10, 0x3, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000180)=[{0x0, 0x48, 0x0, 0x41000000}], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = syz_usb_connect$uac2(0x5, 0xd3, &(0x7f0000000400)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x499, 0x1038, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc1, 0x3, 0x1, 0x9, 0x80, 0xf, {0x8, 0xb, 0x2, 0x1, 0x1, 0x0, 0x20, 0xf8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x9, 0x42, 0x4}, [@processing_unit={0xb, 0x24, 0x8, 0x2, 0x6, [0x3, 0x1, 0x3]}, @mixer_unit={0x6, 0x24, 0x4, 0x1, 0x8f, '+'}, @feature_unit={0xd, 0x24, 0x6, 0x3, 0x3, [0x4, 0xb, 0xb, 0x3]}, @input_terminal={0x10, 0x24, 0x2, 0x1, 0x405, 0x6, 0x8, 0x74, 0x1, 0x1, 0x6, 0xd}, @processing_unit={0xb, 0x24, 0x8, 0x5, 0x1, [0x3, 0x1, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x15, 0x2, 0x47, {0x8, 0x25, 0x1, 0x2, 0xf, 0x10}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x3, 0x1, 0x3, 0x4, "", 'Z'}, @as_header={0x10, 0x24, 0x1, 0xe, 0x80, 0x0, 0x4, 0x8, 0x825, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x440, 0x0, 0x7, 0x0, {0x8, 0x25, 0x1, 0x0, 0x0, 0x5, 0x1002}}}}}}}}]}}, &(0x7f0000000080)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x300, 0x8, 0x51, 0x4, 0x20, 0x7}, 0x10, &(0x7f0000000200)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x2, 0x46, 0x9, 0x6, 0xb, 0x1}]}, 0x1, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x40e}}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="14000000130001ffffff7f8cd913e90002"], 0x14}], 0x1, 0x0, 0x0, 0x44100}, 0x0) recvmsg(r6, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x12000) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x24, 0x40, 0x107, 0x70bd2b, 0x25dfdbfa, {0x3, 0x7c}, [@nested={0x4, 0x1c6}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x4, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x44094}, 0xc000) syz_usb_ep_write(r4, 0xc, 0xa, &(0x7f00000002c0)="6dc9533a36c1b10c8cc1") pread64(r3, &(0x7f0000000000)=""/76, 0x4c, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x50, 0x24, 0xd0f, 0x203, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x2}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x10, 0x3, 0x1, 0x3, 0x400, 0x8}, [@TCA_NETEM_DELAY_DIST={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20048000}, 0x20040880) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) 3.108232511s ago: executing program 4 (id=955): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[], 0x6c}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ppoll(&(0x7f0000000340)=[{r0, 0x82}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000140)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000080)={0x4, 0x29dc5, 0x0, 0x0, 0xd}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r2 = getpid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x8031, 0xffffffffffffffff, 0xd9d76000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sched_getattr(r2, &(0x7f0000000380)={0x38}, 0x38, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) getpriority(0x1, 0x0) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) 2.551361981s ago: executing program 1 (id=956): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r1, 0x0, 0x0) write$bt_hci(r1, &(0x7f0000000000)={0x1, @write_current_iac_lap={{0xc3a, 0x7}, {0x6, "83f46d5c99cc"}}}, 0xb) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000340)={0x14, &(0x7f0000000100)={0x20, 0x24, 0xd4, {0xd4, 0x7777413cbd647fa7, "b9f6527d9cca2dde969d98cb9ac76bf65079dce010bb8bfeb3170b3a782047d36b12477ce68baed38a8c678facb2a203e011032f7a0831a160388a409225d3c3f7dd5b1718e888bc7725c8339bb941e0e2a3209d213f4f6ddefa1c333f2aecb0b9e366ae5dcc2831dfcf7eec40d55bbc710c18876b8e83ff6123c573c940788bb622a7b801851b543717e0e1e6324c8ea569a929d7f4dd36fb8df18ae6f9b2d8a6efc2819a8a3cb2deceb2dde244b769cdf2fb2106947d597b0c5a13a603266eaa9decfb515b69de77399c287b24881055b9"}}, &(0x7f0000000200)={0x0, 0x3, 0x8b, @string={0x8b, 0x3, "cb6261af36dfbce259f8235e700fcd92c1c756f1349873f151a73401c97d82f9403e8b610b577c2dfa0b236d0e96773414eda299e92693ed52751237c25d0e6608d20296182c87e4476bfc8535eab940b456d7944b6c4e88d35ecb54089cd088758c965fe309203fdf6aeb3587c9e8afa41ef576119cead1548faa48c829506ee026afa061f806d2a3"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000380)={0x40, 0x6, 0x9c, "d07648384c9651c891d3560e0c28440b4f2c48f3666257a70f89ea72b230fd0d2e430f20913554f77267598d259f11d7023d51857585bcf3656c61e08e38e51ba7bb7665592467b4e8816a672f9274c96569f28bdd0096f4b5408f150250e421b3bceb9ec0d611d7f0d2c1503481dabed8e049bd695d0881e396aa7c9bfceadd137f6f84da7454c15420ab04971ef7782f327201c8da922bc35aa93e"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000004c0)={0x20, 0x81, 0x2, "c3a9"}, &(0x7f0000000500)={0x20, 0x82, 0x2, "437f"}, &(0x7f0000000540)={0x20, 0x83, 0x1, '@'}, &(0x7f0000000580)={0x20, 0x84, 0x4, "7d0666d1"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "f0cf17"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r4, @ANYRES16=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 2.325998304s ago: executing program 0 (id=957): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000040)={0xc, {0x401, 0x2, 0x1, 0x7}}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xc) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x8) r2 = creat(&(0x7f0000000080)='./file0\x00', 0xc9) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f00000000c0)=0x1) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000100)=0x7, 0x4) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000140)={0x5, 0x0, '\x00', {0x0, @bt={0x4, 0x6, 0x0, 0x2, 0x1, 0x5, 0x5, 0x1, 0xfffffff8, 0x10000, 0x10001, 0x14fd5b7e, 0x7, 0xeb, 0x8, 0xc, {0x1, 0x9}, 0x5, 0x9}}}) readahead(r1, 0x6, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) poll(&(0x7f0000000200)=[{r1, 0x1022}], 0x1, 0x0) fdatasync(r1) r4 = syz_usb_connect$uac1(0x5, 0xfa, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0xccd, 0xb1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe8, 0x3, 0x1, 0x6, 0xa0, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xb1f, 0x2c}, [@extension_unit={0xb, 0x24, 0x8, 0x1, 0xa8, 0x5, "bf0e92d8"}, @processing_unit={0xc, 0x24, 0x7, 0x5, 0x1, 0x40, "c6f50ce8a9"}, @mixer_unit={0xb, 0x24, 0x4, 0x2, 0x5, "3e93f7a909e2"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xf8, 0xab, 0x0, 0x6, 0xf}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x2, 0x2, 0x5, 0x4b, "cdf655d3a1beb13493"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x9, 0xd, 0x1, 0xc}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x3, 0x79c, 0x1, "40862cc49393fae0eb"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x6f, 0x7f, 0x8, {0x7, 0x25, 0x1, 0x0, 0x2, 0xffff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0x6, 0x3, 0x6, 0x5}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x9ba58a1fd570ab54}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x6, 0x3, 0xcd, 0x0, "", "ff"}, @as_header={0x7, 0x24, 0x1, 0x6, 0x28, 0x1001}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x4, 0xe, 0x9, 0x4}, @as_header={0x7, 0x24, 0x1, 0x81, 0x5}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x9, 0xab, 0x55, {0x7, 0x25, 0x1, 0x8, 0x5, 0x6}}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x250, 0xe, 0xf3, 0x6, 0x40, 0xf}, 0x6c, &(0x7f0000000380)={0x5, 0xf, 0x6c, 0x4, [@ssp_cap={0x10, 0x10, 0xa, 0xc, 0x1, 0x800, 0xf00, 0x962, [0xc030]}, @ssp_cap={0x1c, 0x10, 0xa, 0x2, 0x4, 0xa, 0xff0f, 0x0, [0xff0030, 0x0, 0xffff00, 0x1fe00de]}, @generic={0x30, 0x10, 0xb, "17013a0c2cdf3af12eb150bd6fcdf09f21cd4a179c9bd53c0c83279031c844c58fee09fead516e1cb099547187"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x2, 0x5, 0x401, 0x1}]}, 0x3, [{0x9d, &(0x7f0000000400)=@string={0x9d, 0x3, "2cb55da0223d9572ca28d6ca7de75211bf6a53efd41b42c01c6a465734d2d6dfe1e99db1baafed99c2b0a00037e23105aa485963903ab083f7851bb0a8117086fd7c22af5e8584f4c66c07ef4e7035942b8f4af683ff1c35ad567af24899faf3fff34556b40f96c2d747dc2f75f2cfcda377eff895408706b19653452c2d78f8e998eb8e09e6fd29a6158e6567598e37fae9c4c352a3aaa2b65e59"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x280a}}, {0x96, &(0x7f0000000500)=@string={0x96, 0x3, "40f60aa59616c80be28d053713280e022608b5ffb661a14f51838245b40d39330e2da37695892c72bf63a98e9e919d1cb059be22ad6ca9d264423441ccfc058d8f93e1156c136348b8e8621d41607f6e37f4969c5b88790dbf2985a85f5b18bbd5f84cd1ca86c23fc14ee6a294cfc7c3e328701ff9eefbec507266f3cb71e2416d81e9aae9e39fc7665c1ae15c57521ce048da38"}}]}) syz_usb_control_io(r4, &(0x7f0000000840)={0x2c, &(0x7f0000000600)={0x20, 0x22, 0xa7, {0xa7, 0x23, "1e2f2e6cff93edf4967c3351b01276df6d71f81a0643d251ef95dd87ac492ea63aef1b5540a4b1a0621b789b551bec92b0968da3a50786dd1407fc3fe61c7f13c323b4299f08f15ec4ccc8cb83ce4cc86da9c85ac66c4c5dc32fa46e0c794af27144bb0f379b8a7c1d77958016420cb91cf379ad8a1616ee30327a264f5592444d489c85da8637632bc967fb9323b0910c2bb11a62ddd12e80ccd441f46b3ada98d634d41a"}}, &(0x7f00000006c0)={0x0, 0x3, 0xac, @string={0xac, 0x3, "53d57dd09fd949ea7a53040b998f40a3e3ee05ae9d9694a6edfa1ab459b0188889c5986d9e149d5edb968bf225bc5ff98c27edff0e02eca83dbe8e168d1fe36ac1c3554d084c4ce8aba05e89ccf22f21b49221c08c9ae191e61f9704ae56e604b19a5003dfd1887f7d524d2c494a94b9bac8c47b3b4caaeb594a2bc5ad2641c3b12048c8b375fd6ec2f134218e4f511dcb663517cb8d93e878bfa84f4fe041a542adc2dea19ac46c3424"}}, &(0x7f0000000780)={0x0, 0xf, 0x38, {0x5, 0xf, 0x38, 0x3, [@generic={0x22, 0x10, 0xa, "3b54b8bb19fdeef2fb9653462ec0a4b9d0c5e4b9deb502368fcfd3d2872b43"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0xf, 0x4, 0x529}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0xc, 0x0, 0x81}]}}, &(0x7f00000007c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xfa, 0x8, 0x0, 0x2, "c2d80f52", "6cb7d450"}}, &(0x7f0000000800)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x10, 0x18, 0x0, 0x8, 0x6, 0x30, 0x2}}}, &(0x7f0000000d40)={0x84, &(0x7f0000000880)={0x40, 0xf, 0xf5, "cd63f4e1fc110e78e12ae8bd6a3638fa5dbf3ef7379068ae449bcb31ab533d64cadcd29079e16c3265a69ef60571ca2f7b281947d0834e594416337fbfbfcaf3d834b89e911b904175035f362aa9c5b0d61f41c144ea2c31cdda0ad3600ab5000e1f5ab4d6f2eb4b6edd4730803a7e76358b50020ca10de405591eab15af083ea3151c7022e3efba0033337102a6e8bfcd4bab9eb98ac596427df82e9d3cd8a193dce65b22850272d271a087cd045b5ed90396a10764d90b8dfaef80ff5d87816c04f67632ed5b4b214951ecc003f538782362f657048fad5047b68475048e092505a3fbf924f700487a74789caa560e58d519562e"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x1a}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x36}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000a40)={0x20, 0x0, 0x8, {0x101, 0x20, [0x0]}}, &(0x7f0000000a80)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000ac0)={0x40, 0x9, 0x1, 0x2a}, &(0x7f0000000b00)={0x40, 0xb, 0x2, "03b0"}, &(0x7f0000000b40)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000b80)={0x40, 0x13, 0x6, @random="1a1251483e47"}, &(0x7f0000000bc0)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000c00)={0x40, 0x19, 0x2, 'K\t'}, &(0x7f0000000c40)={0x40, 0x1a, 0x2, 0xbda5}, &(0x7f0000000c80)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000cc0)={0x40, 0x1e, 0x1, 0x7f}, &(0x7f0000000d00)={0x40, 0x21, 0x1, 0x42}}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000e00)={0x0, 0x0}) ptrace$ARCH_SET_GS(0x1e, r5, &(0x7f0000000e80), 0x1001) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f0000000ec0)={0xffff, 0x57c, 0x0, 0x7}, 0x8) sched_setaffinity(r5, 0x8, &(0x7f0000000f00)=0xb5e) bind$bt_hci(r2, &(0x7f0000000f40)={0x1f, 0x1}, 0x6) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000fc0), r2) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x14, r7, 0x800, 0x70bd26, 0x25dfdbfc}, 0x14}}, 0x48810) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001100), r2) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r2, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x28, r8, 0x200, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x1, 0x7f}}}}, ["", ""]}, 0x28}}, 0x20040900) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000001240)={0xba, 0x0}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000001280)={r10, 0x2}) getresuid(&(0x7f00000012c0), &(0x7f0000001300), &(0x7f0000001340)) connect$inet6(r2, &(0x7f0000001380)={0xa, 0x4e23, 0x6, @loopback, 0x5}, 0x1c) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x24, 0x0, 0x4, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048000}, 0x40) 1.930647702s ago: executing program 2 (id=958): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000040)={0x4, 0x7, 0x4, 0xffff, 0x0, "008ef14ba278887cb0baba08431799317e6324"}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xe4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f00000031c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r7, &(0x7f00000002c0)={0x130, 0x0, r8, {0x7, 0xc, 0x0, '\x00', {0x86, 0x4af22, 0x6, 0x9, 0x0, r9, 0xa000, '\x00', 0x6, 0x8, 0xd60b, 0x80000000005, {0x4002008, 0xfffffff3}, {0x203d7f, 0x7, 0xc000000}, {0x4000100000000408, 0x72}, {0xfffffffffffffffd, 0xdb23}, 0xffffffff, 0x5, 0x200, 0x8000}}}, 0x130) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r10, &(0x7f0000000000), 0x0, 0x24004001) ioctl$sock_SIOCSIFBR(r11, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x5, 0xc8}) io_submit(r5, 0x20000000000002b5, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.925638149s ago: executing program 4 (id=959): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796", 0x85, 0x5, 0xffffffff}], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {0x0}, {&(0x7f0000000740)}], 0x3}, 0x41) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8a", 0xd6}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="680000000000000017010000020000004f000000bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16000000000018000000000000001701000004000000060000000000000036b01a06bfa0450a95c85e192c3e04beaa663010259f815dcdb6cf3c57b707d8"], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef2860", 0x5c}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc32c3f81f9b1d06cd70a1b428c0", 0x37}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e02801", 0x4d}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4a130246680", 0xd1}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) ioctl$DRM_IOCTL_CONTROL(r2, 0x40086414, &(0x7f0000000600)={0x2, 0xcb}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) getsockname$inet(r4, &(0x7f0000000500)={0x2, 0x0, @loopback}, &(0x7f0000000580)=0x10) 1.661507887s ago: executing program 3 (id=960): r0 = socket$inet6(0x10, 0x3, 0x0) (async, rerun: 64) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000003c0)={0x20, r3, 0x1, 0x78bd25, 0x25d7dbff, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_RULES={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040001}, 0x2400c080) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) (async) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r5, 0x11a, 0x2, 0x0, &(0x7f0000000040)) (async) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r6, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) (async) sendmsg$TIPC_NL_BEARER_SET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x28, r6, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) (async, rerun: 32) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (rerun: 32) connect$bt_rfcomm(r7, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8}, 0xa) (async) sched_setscheduler(0x0, 0x2, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x2, 0x0) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x50, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x10, 0xb}, {0xb, 0x6}, {0x6, 0x7}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x24, 0x2, [@TCA_HHF_NON_HH_WEIGHT={0x8, 0x7, 0x1ed0}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x1}, @TCA_HHF_EVICT_TIMEOUT={0x8, 0x6, 0x9}, @TCA_HHF_QUANTUM={0x8, 0x2, 0x10001}]}}]}, 0x50}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000000c0)={'dummy0\x00'}) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000180), 0x141000, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="14010000290001002dbd7000fcdbdf2503014e8008002f00", @ANYRES32=r9, @ANYBLOB="140001"], 0x114}], 0x1, 0x0, 0x0, 0x40004}, 0x0) (async, rerun: 64) ioctl$TIOCL_BLANKSCREEN(r1, 0x560e, &(0x7f0000000000)) (async, rerun: 64) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2c2280, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) 1.660945227s ago: executing program 4 (id=961): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(xeta)\x00'}, 0x58) 1.634581193s ago: executing program 4 (id=962): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x3a) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000280)="fd72c91726872af17284cbbecb2360cff1988314f6cc09c4c07f0b44d9c16a610f294283b780b506b765d798ca8ab5adc7424057689ee5685dc17105c83aa4ed88bbfc7fef38b630105a17b9c6febfaef81e3242f4b460a05490dce8fd165641538fff4d4f46f9e24217a754881ce31e40b204d9126e3103f7aedd9c3194c82a62744ab6", 0x84}, {&(0x7f00000000c0)="6eafae9268cbdef2c4610d53e85605490ed6ed506c0b5fbe97b851b9277a5dac0ab88672b8ac5b883cff936f9216ae43f0061ee6421eade3910dc65d94f385486c94", 0x42}], 0x3, &(0x7f0000000440)=[@rights={{0x2c, 0x1, 0x1, [r0, r0, r0, r0, r1, r0, r0]}}], 0x30}, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x17, 0x0, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r3}, 0xc) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80000) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r2, 0x4004510d, &(0x7f0000000000)) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) connect$l2tp6(r5, &(0x7f0000000180)={0xa, 0x0, 0xfffff801, @empty, 0x0, 0x3}, 0x20) r6 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x8}, 0x20) read$char_usb(0xffffffffffffffff, &(0x7f0000000040)=""/236, 0xec) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[], 0x0, 0xd2}, 0x28) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) 1.604273556s ago: executing program 3 (id=963): socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) syz_emit_ethernet(0x5e, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000104000280600fe880000000000000000000000000001fe8000000000000000000000000000aa00004e22889632efe977fe4e41fdb65a647547231645128905574024c13bd9f7178052786152a452d759cdd4c4fc3731406e7981546afb", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a4000000907806c31d12d2b653e0c9d32072c19dd6ca814b7d7b0000"], 0x0) utimes(&(0x7f0000000000)='./file1\x00', 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4004040) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25fe880000000000000000000000000101ffffffff000000000000000000000000000000004e2400000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000021000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffffffffff000000000000000000000000000000000500000000000000000000000020000000000000000000000000000000000000010002020000000044000500e0000001000000000000000000000000000004d632"], 0xfc}, 0x1, 0x0, 0x0, 0x20080004}, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r2, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @remote}}}], 0x20}, 0x20002880) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0xb4, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa0, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) 649.78913ms ago: executing program 4 (id=964): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000bc0)={0x24, &(0x7f0000000240)={0x40, 0x5, 0xc, {0xc, 0x23, "f8ba937b52291634046f"}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000940)={0x84, 0x0, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000005c0)={0x0, 0x8, 0x1}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x5}, 0x0, &(0x7f0000000740)={0x40, 0xf, 0x2, 0xfff}, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x6}, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$uac1(0x3, 0xb8, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201500200000008990425104000010203010902a60003010110020904000000010100000a2401040029000201020b240402062974f2ee440a092407030100742f590b240606010201000900030904010000010200000904010101010200000b240201d80109027960340924020101010dcbdc0a240201030407"], 0x0) syz_usb_ep_write(r0, 0x81, 0x47, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d9000000") 646.712514ms ago: executing program 3 (id=965): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000500)={0x3a, &(0x7f00000005c0)=[{0x12, '\x00', @buffer={"e0615f1132b11e4f262e9c15e3f5cafa7c7aba49c3223610f23af1dd27b037b0", 0x20}}, {0x2e, '\x00', @data=0x80000000, 0x9}, {0x38, '\x00', @st={0x4, [{0x3, @uvalue=0x5}, {0x2, @uvalue=0x5}, {0x2, @svalue=0xc6}, {0x1, @svalue=0x7}]}, 0x12}]}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000700)={0x2c, r3, 0x8d61ddcfedb48df, 0x70bd25, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @ETHTOOL_A_FEATURES_WANTED={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x2c}}, 0x0) r6 = socket(0x10, 0x803, 0x0) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001d40)=ANY=[@ANYBLOB="581800004400010029bd7000040000000100000004004880401801"], 0x1858}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r8, 0x40046}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MTU={0x8, 0x4, 0x6d}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sndpcmc(&(0x7f0000000900), 0x1, 0x0) r9 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r10 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r10]) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e22, @private=0xa010100}, @in={0x2, 0x4e24, @private=0xa010100}, @in6={0xa, 0x4e21, 0xc59, @rand_addr=' \x01\x00', 0x2}], 0x4c) syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) r11 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000018, 0x11, r11, 0x0) r12 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') epoll_ctl$EPOLL_CTL_ADD(r12, 0x1, r0, &(0x7f0000000180)={0x1}) preadv(r12, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) 597.693172ms ago: executing program 0 (id=966): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0xa, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x1c0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000140)={0x100, r2}, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) landlock_restrict_self(r1, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x81c0, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000240)={0x20}, 0x18, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0/file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f00000002c0)={0x20, r4}, 0x0) landlock_restrict_self(r3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000300)='./file0/file0/file0\x00', 0x81c0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000340)='./file0/file0/file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file1\x00', 0x81c0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1\x00', 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000400), 0x4) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 311.322123ms ago: executing program 2 (id=967): socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000800)={'tunl0\x00', &(0x7f0000000740)={'sit0\x00', 0x0, 0x700, 0x80, 0xb83, 0x80000001, {{0x6, 0x4, 0x2, 0x3d, 0x18, 0x65, 0x0, 0x7e, 0x4, 0x0, @private=0xa010100, @multicast1, {[@rr={0x7, 0x3, 0x2f}, @noop]}}}}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b00)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_BLANKSCREEN(r4, 0x560e, &(0x7f0000000000)) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000000), 0x4) 0s ago: executing program 0 (id=968): syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d98", 0xd9}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005f", 0xa1}, {&(0x7f0000000ac0)="3fe4c8a328", 0x5}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4", 0xcc}], 0x3, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000680)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) io_uring_setup(0x1028, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0x70000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x9, 0x0, 0x10}, {0x6000, 0xd000, 0xc, 0x8, 0x0, 0x3, 0x6, 0xb2, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0xe2, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0xd000, 0xd, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0x0, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x8000000, 0x0, 0x6, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffffffffe, 0xd801, 0x0, [0x4, 0x0, 0x1]}) close(0x5) r7 = socket(0x40000000015, 0x5, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) r8 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f00000002c0)={0x10200, 0x4, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r6, 0x4068aea3, &(0x7f0000000600)={0xbc, 0x0, 0x6}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) kernel console output (not intermixed with test programs): b 2-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 185.601897][ T805] usb 2-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 185.625703][ T805] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 185.639316][ T805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 25972, setting to 1024 [ 185.654945][ T805] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 1024 [ 185.679327][ T805] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 185.694545][ T805] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.707236][ T805] usb 2-1: Product: syz [ 185.752853][ T805] usb 2-1: Manufacturer: syz [ 185.776807][ T805] usb 2-1: SerialNumber: syz [ 185.830718][ T805] usb 2-1: config 0 descriptor?? [ 185.857550][ T7797] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 185.906194][ T805] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 185.960058][ T805] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 186.098446][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 186.098462][ T29] audit: type=1400 audit(1782040358.818:483): avc: denied { write } for pid=7811 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.134843][ T805] usb 2-1: USB disconnect, device number 37 [ 186.172689][ T7824] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 186.204067][ T29] audit: type=1400 audit(1782040358.928:484): avc: denied { write } for pid=7829 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.226114][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 186.322555][ T29] audit: type=1400 audit(1782040359.048:485): avc: denied { write } for pid=7832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.373086][ T29] audit: type=1400 audit(1782040359.098:486): avc: denied { write } for pid=7843 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.396161][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 186.404255][ T9] usb 3-1: config 0 has no interface number 0 [ 186.410963][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 186.425167][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 186.434980][ T9] usb 3-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 186.444082][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.455667][ T9] usb 3-1: config 0 descriptor?? [ 186.585347][ T29] audit: type=1400 audit(1782040359.308:487): avc: denied { write } for pid=7845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.627265][ T29] audit: type=1400 audit(1782040359.348:488): avc: denied { write } for pid=7858 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 186.718508][ T29] audit: type=1400 audit(1782040359.438:489): avc: denied { map } for pid=7863 comm="syz.1.594" path="socket:[16938]" dev="sockfs" ino=16938 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 186.730375][ T5611] kernel read not supported for file /dsp1 (pid: 5611 comm: kworker/0:3) [ 186.956835][ T805] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 187.035954][ T9] input: HID 04d9:a055 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.1/0003:04D9:A055.0009/input/input37 [ 187.094174][ T29] audit: type=1400 audit(1782040359.818:490): avc: denied { write } for pid=7862 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 187.120699][ T805] usb 1-1: Using ep0 maxpacket: 16 [ 187.132577][ T9] holtek_kbd 0003:04D9:A055.0009: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.2-1/input1 [ 187.159727][ T805] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 187.185470][ T805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 187.201406][ T9] usb 3-1: USB disconnect, device number 24 [ 187.231849][ T805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 187.237110][ T7891] fido_id[7891]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 187.268453][ T805] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 187.278272][ T29] audit: type=1400 audit(1782040359.998:491): avc: denied { write } for pid=7893 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 187.320457][ T5611] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 187.322304][ T805] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 187.388984][ T805] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 187.407447][ T805] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 187.464084][ T805] usb 1-1: Manufacturer: syz [ 187.470871][ T805] usb 1-1: config 0 descriptor?? [ 187.510286][ T5611] usb 5-1: Using ep0 maxpacket: 16 [ 187.518115][ T5611] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 187.527303][ T5611] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.576533][ T5611] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 187.695076][ T5611] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 187.729737][ T5611] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.769182][ T5611] usb 5-1: Product: syz [ 187.789651][ T5611] usb 5-1: Manufacturer: syz [ 187.833784][ T5611] usb 5-1: SerialNumber: syz [ 187.931954][ T5611] usb 5-1: 0:2 : does not exist [ 188.600290][ T805] rc_core: IR keymap rc-hauppauge not found [ 188.614020][ T805] Registered IR keymap rc-empty [ 188.647240][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 188.658250][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.664621][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.713385][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 188.754555][ T805] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 188.799603][ T805] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input38 [ 188.873998][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 188.888074][ T29] audit: type=1400 audit(1782040361.608:492): avc: denied { write } for pid=7898 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 188.970477][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.005567][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.060631][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.068744][ T7926] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 189.181849][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.210389][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.230451][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.551214][ T5611] usb 5-1: USB disconnect, device number 21 [ 189.575482][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.600331][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.640325][ T805] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 189.650510][ T5717] kernel read not supported for file /dsp1 (pid: 5717 comm: kworker/0:4) [ 189.670988][ T805] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 189.690415][ T805] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 189.718403][ T805] usb 1-1: USB disconnect, device number 24 [ 190.160283][ T805] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 190.320271][ T805] usb 1-1: Using ep0 maxpacket: 8 [ 190.336226][ T805] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 190.358146][ T805] usb 1-1: config 0 has no interface number 1 [ 190.374357][ T805] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 190.396764][ T805] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 190.420288][ T805] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 190.526595][ T805] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 190.550354][ T805] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 190.578773][ T805] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 190.603645][ T805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 25972, setting to 1024 [ 190.628076][ T805] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 1024 [ 190.649090][ T805] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 190.659908][ T805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.669014][ T805] usb 1-1: Product: syz [ 190.673266][ T805] usb 1-1: Manufacturer: syz [ 190.677936][ T805] usb 1-1: SerialNumber: syz [ 190.691159][ T805] usb 1-1: config 0 descriptor?? [ 190.698043][ T7935] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 190.705816][ T7951] overlayfs: failed to resolve './bus': -2 [ 190.707044][ T805] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 190.720906][ T805] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 190.918506][ T805] usb 1-1: USB disconnect, device number 25 [ 190.947661][ T7956] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 191.500313][ T5611] kernel read not supported for file /dsp1 (pid: 5611 comm: kworker/0:3) [ 191.980436][ T5611] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 192.021029][ T7979] random: crng reseeded on system resumption [ 192.037850][ T7979] syzkaller1: entered promiscuous mode [ 192.044781][ T7979] syzkaller1: entered allmulticast mode [ 192.140470][ T5611] usb 1-1: Using ep0 maxpacket: 32 [ 192.146873][ T5611] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 192.155170][ T5611] usb 1-1: config 0 has no interface number 0 [ 192.163522][ T5611] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 192.172615][ T5611] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.180681][ T5611] usb 1-1: Product: syz [ 192.184861][ T5611] usb 1-1: Manufacturer: syz [ 192.189466][ T5611] usb 1-1: SerialNumber: syz [ 192.194800][ T5611] usb 1-1: config 0 descriptor?? [ 192.202309][ T5611] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 192.211170][ T5611] usb 1-1: selecting invalid altsetting 1 [ 192.216891][ T5611] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 192.225101][ T5611] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 192.235377][ T5611] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 192.243686][ T5611] usb 1-1: media controller created [ 192.251639][ T5611] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 192.355123][ T805] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 192.362798][ T5703] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 192.531577][ T805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 192.542487][ T5703] usb 3-1: config 43 interface 0 has no altsetting 0 [ 192.549730][ T805] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 192.559622][ T805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.571675][ T5703] usb 3-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 192.581170][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.607649][ T805] usb 4-1: config 0 descriptor?? [ 192.615889][ T5703] usb 3-1: Product: syz [ 192.621419][ T5703] usb 3-1: Manufacturer: syz [ 192.631956][ T5703] usb 3-1: SerialNumber: syz [ 192.650445][ T5710] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 192.820465][ T5710] usb 5-1: Using ep0 maxpacket: 8 [ 192.829163][ T5710] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 192.842850][ T5710] usb 5-1: config 0 has no interface number 1 [ 192.849706][ T805] usbhid 4-1:0.0: can't add hid device: -71 [ 192.858969][ T5710] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 192.872093][ T805] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 192.881696][ T5703] usb 3-1: dvb_usb_v2: found a 'Anysee' in warm state [ 192.891407][ T805] usb 4-1: USB disconnect, device number 16 [ 192.897388][ T5710] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 192.910496][ T5703] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 192.920486][ T5703] dvb_usb_anysee 3-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 192.931397][ T5710] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 192.945233][ T5703] usb 3-1: USB disconnect, device number 25 [ 192.952983][ T5710] usb 5-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 192.965721][ T5710] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 192.980454][ T5710] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 192.992300][ T5710] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 193.002284][ T5710] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 193.013810][ T5710] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 193.023212][ T5710] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.031364][ T5710] usb 5-1: Product: syz [ 193.035625][ T5710] usb 5-1: Manufacturer: syz [ 193.040361][ T5710] usb 5-1: SerialNumber: syz [ 193.049651][ T5710] usb 5-1: config 0 descriptor?? [ 193.063274][ T7986] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 193.075210][ T5710] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 193.084261][ T5710] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 193.103622][ T5710] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 193.282407][ T5703] usb 5-1: USB disconnect, device number 22 [ 193.290491][ T5611] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 193.298191][ T5611] zl10353_read_register: readreg error (reg=127, ret==-110) [ 193.310590][ T7973] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 193.333360][ T5611] usb 1-1: USB disconnect, device number 26 [ 193.380661][ T805] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 193.541696][ T805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.552887][ T805] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 193.563095][ T805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.572884][ T805] usb 4-1: config 0 descriptor?? [ 193.969100][ T7999] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 194.391502][ T7981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.401278][ T805] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 194.409906][ T7981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.418416][ T805] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input39 [ 194.520851][ T805] kernel read not supported for file /dsp1 (pid: 805 comm: kworker/1:2) [ 194.919392][ T8017] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8017 comm=syz.0.631 [ 194.948777][ T805] usb 4-1: USB disconnect, device number 17 [ 194.948803][ C1] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 195.072586][ T8022] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 195.230432][ T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 195.410503][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 195.500363][ T9] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 195.511248][ T9] usb 1-1: config 0 has no interface number 0 [ 195.517550][ T9] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 195.537304][ T9] usb 1-1: config 0 interface 85 has no altsetting 0 [ 195.573512][ T9] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 195.598109][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.626062][ T9] usb 1-1: Product: syz [ 195.641289][ T9] usb 1-1: Manufacturer: syz [ 195.674662][ T9] usb 1-1: SerialNumber: syz [ 195.722356][ T9] usb 1-1: config 0 descriptor?? [ 195.861554][ T8031] random: crng reseeded on system resumption [ 195.955485][ T8031] syzkaller1: entered promiscuous mode [ 195.964278][ T8031] syzkaller1: entered allmulticast mode [ 196.298726][ T5717] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 196.338163][ T8033] overlayfs: failed to resolve './bus': -2 [ 196.401082][ T9] appletouch 1-1:0.85: Failed to request geyser raw mode [ 196.428126][ T9] appletouch 1-1:0.85: probe with driver appletouch failed with error -5 [ 196.452516][ T9] usb 1-1: USB disconnect, device number 27 [ 196.476046][ T5717] usb 4-1: config 43 interface 0 has no altsetting 0 [ 196.480810][ T8038] syzkaller1: entered promiscuous mode [ 196.488275][ T8038] syzkaller1: entered allmulticast mode [ 196.488548][ T5717] usb 4-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 196.503255][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.512296][ T5717] usb 4-1: Product: syz [ 196.516591][ T5717] usb 4-1: Manufacturer: syz [ 196.521497][ T5717] usb 4-1: SerialNumber: syz [ 196.735949][ T5717] usb 4-1: dvb_usb_v2: found a 'Anysee' in warm state [ 196.742841][ T5717] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 196.750147][ T5717] dvb_usb_anysee 4-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 196.760466][ T805] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 196.765091][ T5717] usb 4-1: USB disconnect, device number 18 [ 196.924300][ T805] usb 3-1: config 43 interface 0 has no altsetting 0 [ 196.951750][ T805] usb 3-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 196.971906][ T805] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.982988][ T805] usb 3-1: Product: syz [ 196.988746][ T805] usb 3-1: Manufacturer: syz [ 196.995815][ T805] usb 3-1: SerialNumber: syz [ 197.303068][ T8048] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 197.375227][ T805] usb 3-1: dvb_usb_v2: found a 'Anysee' in warm state [ 197.384030][ T805] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 197.390762][ T805] dvb_usb_anysee 3-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 197.408035][ T805] usb 3-1: USB disconnect, device number 26 [ 197.510076][ T5710] IPVS: starting estimator thread 0... [ 197.650334][ T8055] IPVS: using max 75 ests per chain, 180000 per kthread [ 197.930502][ T5710] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 198.098519][ T5710] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 198.143506][ T5710] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 198.202932][ T5710] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 198.244741][ T5710] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 198.270653][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.299373][ T5710] usb 4-1: Product: syz [ 198.309641][ T5710] usb 4-1: Manufacturer: syz [ 198.317051][ T5710] usb 4-1: SerialNumber: syz [ 198.408144][ T5710] usb 4-1: config 0 descriptor?? [ 198.443302][ T8058] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 198.506239][ T8058] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 198.751558][ T5710] usb 4-1: ucan: probing device on interface #0 [ 199.140695][ T5710] usb 4-1: ucan: device reported invalid device info [ 199.161682][ T5710] usb 4-1: ucan: probe failed; try to update the device firmware [ 199.693751][ T8058] No such timeout policy "syz1" [ 199.709065][ T5611] usb 4-1: USB disconnect, device number 19 [ 200.280442][ T5611] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 201.060380][ T5611] usb 5-1: Using ep0 maxpacket: 8 [ 201.075699][ T5611] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 201.094795][ T5611] usb 5-1: config 0 has no interface number 1 [ 201.118949][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 201.158884][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 201.186351][ T5611] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 201.217660][ T5611] usb 5-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 201.238227][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 201.272067][ T5611] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 201.307145][ T5611] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 201.342841][ T5611] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 201.362803][ T5611] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 201.380472][ T5611] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.388582][ T5611] usb 5-1: Product: syz [ 201.409913][ T5611] usb 5-1: Manufacturer: syz [ 201.414840][ T5611] usb 5-1: SerialNumber: syz [ 201.423496][ T5611] usb 5-1: config 0 descriptor?? [ 201.429309][ T8090] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 201.441938][ T5611] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 201.453000][ T5611] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 201.487100][ T5611] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 201.718666][ T5710] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 201.841949][ T5611] usb 5-1: USB disconnect, device number 23 [ 202.503942][ T8113] random: crng reseeded on system resumption [ 202.565994][ T8113] syzkaller1: entered promiscuous mode [ 202.571680][ T8113] syzkaller1: entered allmulticast mode [ 202.650310][ T5710] usb 3-1: Using ep0 maxpacket: 16 [ 202.656608][ T5710] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.667558][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 202.678894][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 202.688675][ T5710] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 202.698477][ T5710] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 202.713057][ T5710] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 202.722247][ T5710] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 202.730931][ T5710] usb 3-1: Manufacturer: syz [ 202.739371][ T5710] usb 3-1: config 0 descriptor?? [ 202.770316][ T5611] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 202.840302][ T5702] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 202.925538][ T5611] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 202.934840][ T5611] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.943277][ T5611] usb 2-1: Product: syz [ 202.947710][ T5611] usb 2-1: Manufacturer: syz [ 202.952727][ T5611] usb 2-1: SerialNumber: syz [ 202.961067][ T5611] usb 2-1: config 0 descriptor?? [ 202.977186][ T5611] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 203.011906][ T5702] usb 5-1: config 43 interface 0 has no altsetting 0 [ 203.020666][ T5702] usb 5-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 203.030038][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.038350][ T5702] usb 5-1: Product: syz [ 203.042831][ T5702] usb 5-1: Manufacturer: syz [ 203.047460][ T5702] usb 5-1: SerialNumber: syz [ 203.100345][ T5710] rc_core: IR keymap rc-hauppauge not found [ 203.106327][ T5710] Registered IR keymap rc-empty [ 203.111855][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.130371][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.150670][ T5710] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 203.163208][ T5710] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input41 [ 203.178340][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.194418][ T8115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.205064][ T8115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.283850][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.303496][ T5702] usb 5-1: dvb_usb_v2: found a 'Anysee' in warm state [ 203.311321][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.319599][ T5702] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 203.326265][ T5702] dvb_usb_anysee 5-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 203.337478][ T5702] usb 5-1: USB disconnect, device number 24 [ 203.343488][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.370325][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.390473][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.410327][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.430628][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.450311][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.470430][ T5710] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 203.491035][ T5710] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 203.499091][ T5710] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 203.507865][ T5611] gspca_sunplus: reg_r err -110 [ 203.512712][ T5710] usb 3-1: USB disconnect, device number 27 [ 204.270528][ T5611] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 204.386595][ T8134] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 204.430439][ T5611] usb 5-1: Using ep0 maxpacket: 8 [ 204.436917][ T5611] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 204.445388][ T5611] usb 5-1: config 0 has no interface number 1 [ 204.451684][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 204.462733][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 204.474462][ T5611] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 204.485793][ T5611] usb 5-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 204.496051][ T5611] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 204.509254][ T5611] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 204.520771][ T5611] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 204.530566][ T5611] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 204.542012][ T5611] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 204.551124][ T5611] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.559133][ T5611] usb 5-1: Product: syz [ 204.563735][ T5611] usb 5-1: Manufacturer: syz [ 204.568355][ T5611] usb 5-1: SerialNumber: syz [ 204.574070][ T5611] usb 5-1: config 0 descriptor?? [ 204.579450][ T8128] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 204.587897][ T5611] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 204.596206][ T5611] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 204.613208][ T5611] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 204.862167][ T9] usb 5-1: USB disconnect, device number 25 [ 204.930321][ T5702] kernel read not supported for file /dsp1 (pid: 5702 comm: kworker/1:3) [ 205.040298][ T5611] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 205.191487][ T5611] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 205.200684][ T5611] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.210035][ T5611] usb 4-1: config 0 descriptor?? [ 205.223885][ T5611] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 205.240378][ T5702] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 205.391721][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 205.411939][ T5702] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 205.432257][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 205.453006][ T5702] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 205.476334][ T5702] usb 3-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 205.492915][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.509728][ T5702] usb 3-1: Product: syz [ 205.518446][ T5702] usb 3-1: Manufacturer: syz [ 205.527386][ T5702] usb 3-1: SerialNumber: syz [ 205.566136][ T9] usb 2-1: USB disconnect, device number 38 [ 205.574123][ T5702] usb 3-1: config 0 descriptor?? [ 205.602920][ T5702] ums-isd200 3-1:0.0: USB Mass Storage device detected [ 207.180759][ T5702] scsi host1: usb-storage 3-1:0.0 [ 207.251194][ T8163] netlink: 'syz.0.674': attribute type 2 has an invalid length. [ 207.311634][ T8164] netlink: 'syz.0.674': attribute type 2 has an invalid length. [ 207.899769][ T5702] usb 3-1: USB disconnect, device number 28 [ 208.271946][ T5611] usb 4-1: USB disconnect, device number 20 [ 211.507783][ T8199] netlink: 12 bytes leftover after parsing attributes in process `syz.2.683'. [ 211.742156][ T8204] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 211.880358][ T5717] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 212.426606][ T9] kernel read not supported for file /dsp1 (pid: 9 comm: kworker/0:0) [ 212.479214][ T5717] usb 3-1: Using ep0 maxpacket: 8 [ 212.582443][ T5717] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=99.03 [ 212.591764][ T5717] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.600520][ T5717] usb 3-1: Product: syz [ 212.604710][ T5717] usb 3-1: Manufacturer: syz [ 212.609327][ T5717] usb 3-1: SerialNumber: syz [ 212.615347][ T5717] usb 3-1: config 0 descriptor?? [ 212.622266][ T5717] dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state. [ 212.631700][ T5717] dvb-usb: bulk message failed: -22 (2/0) [ 212.637467][ T5717] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 212.652408][ T5717] dvbdev: DVB: registering new adapter (TerraTec/qanu USB2.0 Highspeed DVB-T Receiver) [ 212.662435][ T5717] usb 3-1: media controller created [ 212.672569][ T5717] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 212.684570][ T5717] dvb-usb: bulk message failed: -22 (1/0) [ 212.690440][ T5717] dvb-usb: no frontend was attached by 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' [ 212.711228][ T5717] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input42 [ 212.730964][ T5717] dvb-usb: schedule remote query interval to 50 msecs. [ 212.747049][ T5717] dvb-usb: bulk message failed: -22 (2/0) [ 212.753070][ T5717] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Receiver successfully initialized and connected. [ 212.800368][ T5717] dvb-usb: bulk message failed: -22 (1/0) [ 212.806151][ T5717] dvb-usb: error while querying for an remote control event. [ 212.847484][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 212.847500][ T29] audit: type=1400 audit(1782040385.568:494): avc: denied { block_suspend } for pid=8200 comm="syz.2.684" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 212.870294][ T805] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 212.875643][ T5717] dvb-usb: bulk message failed: -22 (1/0) [ 212.888614][ T5717] dvb-usb: error while querying for an remote control event. [ 212.901977][ T5703] usb 3-1: USB disconnect, device number 29 [ 212.910340][ T5702] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 212.924479][ T5703] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Re successfully deinitialized and disconnected. [ 213.020385][ T5710] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 213.074215][ T5702] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 213.083898][ T8221] netlink: 'syz.0.690': attribute type 2 has an invalid length. [ 213.093858][ T5702] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.107308][ T805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 213.135241][ T8222] netlink: 'syz.0.690': attribute type 2 has an invalid length. [ 213.152258][ T5702] usb 5-1: config 0 descriptor?? [ 213.161043][ T805] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 213.174871][ T5710] usb 4-1: Using ep0 maxpacket: 16 [ 213.216132][ T5702] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 213.233952][ T805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 213.257390][ T5710] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 213.306092][ T805] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 213.317738][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.354331][ T5710] usb 4-1: Product: syz [ 213.383263][ T5710] usb 4-1: Manufacturer: syz [ 213.401932][ T5710] usb 4-1: SerialNumber: syz [ 213.436314][ T805] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 213.464768][ T5710] usb 4-1: config 0 descriptor?? [ 213.493248][ T805] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.521370][ T5710] ssu100 4-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 213.547401][ T805] usb 2-1: Product: syz [ 213.567488][ T805] usb 2-1: Manufacturer: syz [ 213.587096][ T805] usb 2-1: SerialNumber: syz [ 213.650868][ T805] usb 2-1: config 0 descriptor?? [ 213.735497][ T805] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 213.861097][ T5710] ssu100 4-1:0.0: probe with driver ssu100 failed with error -110 [ 214.043564][ T805] scsi host1: usb-storage 2-1:0.0 [ 214.218629][ T805] usb 2-1: USB disconnect, device number 39 [ 214.280371][ T5702] usb 5-1: USB disconnect, device number 26 [ 214.317569][ T8232] FAULT_INJECTION: forcing a failure. [ 214.317569][ T8232] name failslab, interval 1, probability 0, space 0, times 0 [ 214.330396][ T8232] CPU: 0 UID: 0 PID: 8232 Comm: syz.2.691 Tainted: G L syzkaller #0 PREEMPT(full) [ 214.330424][ T8232] Tainted: [L]=SOFTLOCKUP [ 214.330429][ T8232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 214.330439][ T8232] Call Trace: [ 214.330444][ T8232] [ 214.330449][ T8232] dump_stack_lvl+0x100/0x190 [ 214.330475][ T8232] should_fail_ex.cold+0x5/0xa [ 214.330495][ T8232] ? fs_reclaim_acquire+0x70/0x100 [ 214.330515][ T8232] ? tomoyo_encode2+0xfb/0x3c0 [ 214.330531][ T8232] should_failslab+0xc2/0x120 [ 214.330549][ T8232] __kmalloc_noprof+0xe0/0x840 [ 214.330571][ T8232] ? d_absolute_path+0x136/0x1b0 [ 214.330594][ T8232] tomoyo_encode2+0xfb/0x3c0 [ 214.330610][ T8232] tomoyo_encode+0x29/0x50 [ 214.330625][ T8232] tomoyo_realpath_from_path+0x18c/0x690 [ 214.330645][ T8232] tomoyo_path_number_perm+0x23c/0x580 [ 214.330667][ T8232] ? tomoyo_path_number_perm+0x22e/0x580 [ 214.330689][ T8232] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 214.330715][ T8232] ? preempt_count_add+0x76/0x150 [ 214.330739][ T8232] ? rcu_is_watching+0x12/0xc0 [ 214.330768][ T8232] ? __fget_files+0x215/0x3d0 [ 214.330793][ T8232] ? hook_file_ioctl_common+0x140/0x440 [ 214.330813][ T8232] ? lock_release+0x24d/0x310 [ 214.330833][ T8232] ? __fget_files+0x21f/0x3d0 [ 214.330857][ T8232] security_file_ioctl+0xd3/0x230 [ 214.330884][ T8232] __x64_sys_ioctl+0xb7/0x210 [ 214.330905][ T8232] do_syscall_64+0x115/0x870 [ 214.330922][ T8232] ? clear_bhb_loop+0x40/0x90 [ 214.330942][ T8232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.330959][ T8232] RIP: 0033:0x7f74f719ce59 [ 214.330973][ T8232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 214.330991][ T8232] RSP: 002b:00007f74f8107028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 214.331008][ T8232] RAX: ffffffffffffffda RBX: 00007f74f7415fa0 RCX: 00007f74f719ce59 [ 214.331020][ T8232] RDX: 0000000000000000 RSI: 0000000040046208 RDI: 0000000000000005 [ 214.331030][ T8232] RBP: 00007f74f8107090 R08: 0000000000000000 R09: 0000000000000000 [ 214.331040][ T8232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.331050][ T8232] R13: 00007f74f7416038 R14: 00007f74f7415fa0 R15: 00007ffe673615a8 [ 214.331066][ T8232] [ 214.331078][ T8232] ERROR: Out of memory at tomoyo_realpath_from_path. [ 214.374584][ T5710] usb 4-1: USB disconnect, device number 21 [ 215.508749][ T8252] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 215.631431][ T8252] 9p: Bad value for 'wfdno' [ 216.508885][ T8269] overlayfs: failed to resolve './bus': -2 [ 216.532921][ T8271] random: crng reseeded on system resumption [ 216.898309][ T8271] syzkaller1: entered promiscuous mode [ 216.904040][ T8271] syzkaller1: entered allmulticast mode [ 217.160281][ T5710] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 217.160314][ T9] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 217.210312][ T805] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 217.311362][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 217.330296][ T5710] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 217.332884][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 217.344371][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 217.359893][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.369977][ T805] usb 2-1: config 43 interface 0 has no altsetting 0 [ 217.377756][ T9] usb 5-1: config 0 descriptor?? [ 217.384315][ T5710] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 217.386093][ T9] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 217.405363][ T805] usb 2-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 217.421733][ T5710] usb 3-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 217.440318][ T805] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.448380][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.457400][ T805] usb 2-1: Product: syz [ 217.464782][ T805] usb 2-1: Manufacturer: syz [ 217.473930][ T5710] usb 3-1: Product: syz [ 217.478178][ T805] usb 2-1: SerialNumber: syz [ 217.487290][ T5710] usb 3-1: Manufacturer: syz [ 217.500296][ T5710] usb 3-1: SerialNumber: syz [ 217.512505][ T5710] usb 3-1: config 0 descriptor?? [ 217.527831][ T5710] ums-isd200 3-1:0.0: USB Mass Storage device detected [ 217.706290][ T805] usb 2-1: dvb_usb_v2: found a 'Anysee' in warm state [ 217.733609][ T805] usb 2-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 217.747593][ T805] dvb_usb_anysee 2-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 217.758361][ T5710] scsi host1: usb-storage 3-1:0.0 [ 217.778821][ T5710] usb 3-1: USB disconnect, device number 30 [ 217.789980][ T805] usb 2-1: USB disconnect, device number 40 [ 219.015357][ T9] usb 5-1: USB disconnect, device number 27 [ 219.196058][ T5710] IPVS: starting estimator thread 0... [ 219.244178][ T8313] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 219.330134][ T8317] overlayfs: failed to resolve './bus': -2 [ 219.382714][ T8311] IPVS: using max 87 ests per chain, 208800 per kthread [ 219.883755][ T9] kernel read not supported for file /dsp1 (pid: 9 comm: kworker/0:0) [ 221.239000][ T8352] overlayfs: failed to resolve './bus': -2 [ 221.437788][ T8358] IPVS: dh: FWM 3 0x00000003 - no destination available [ 221.449578][ T8357] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8357 comm=syz.3.730 [ 221.478926][ T8357] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 221.494273][ T8357] bond1: (slave lo): Enslaving as an active interface with an up link [ 221.506502][ T8357] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 221.532397][ T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 221.691609][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 221.700796][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.709993][ T9] usb 3-1: config 0 descriptor?? [ 221.720095][ T9] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 222.080318][ T805] kernel read not supported for file /dsp1 (pid: 805 comm: kworker/1:2) [ 222.126213][ T29] audit: type=1400 audit(1782040394.848:495): avc: denied { create } for pid=8368 comm="syz.3.733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 223.108949][ T9] usb 3-1: USB disconnect, device number 31 [ 223.223150][ T8382] netlink: 'syz.4.737': attribute type 2 has an invalid length. [ 223.282474][ T8383] netlink: 'syz.4.737': attribute type 2 has an invalid length. [ 225.920873][ T8407] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 226.241445][ T5717] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 226.450332][ T5717] usb 3-1: Using ep0 maxpacket: 16 [ 226.456898][ T5717] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.467686][ T5717] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 226.479286][ T5717] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 226.489330][ T5717] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 226.499388][ T5717] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 226.500291][ T805] kernel read not supported for file /dsp1 (pid: 805 comm: kworker/1:2) [ 226.513404][ T5717] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 226.539792][ T5717] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 226.548427][ T5717] usb 3-1: Manufacturer: syz [ 226.569088][ T5717] usb 3-1: config 0 descriptor?? [ 226.601632][ T9] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 226.830305][ T5710] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 227.076197][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 227.088797][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 227.111537][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 227.133604][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 227.143338][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 227.153074][ T5717] rc_core: IR keymap rc-hauppauge not found [ 227.159013][ T5717] Registered IR keymap rc-empty [ 227.161431][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 227.163916][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 227.186668][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.190334][ T5710] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 227.204658][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 227.213793][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 227.213852][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.230716][ T9] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 227.233629][ T5710] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 227.238814][ T9] usb 1-1: Manufacturer: syz [ 227.253715][ T5717] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 227.266237][ T5717] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input43 [ 227.271737][ T5710] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 227.280189][ T9] usb 1-1: config 0 descriptor?? [ 227.297463][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.300266][ T5710] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.320417][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.327816][ T5710] usb 2-1: Product: syz [ 227.332284][ T5710] usb 2-1: Manufacturer: syz [ 227.341778][ T5710] usb 2-1: SerialNumber: syz [ 227.350497][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.358568][ T5710] usb 2-1: config 0 descriptor?? [ 227.370446][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.371545][ T5710] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 227.390593][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.411325][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.430382][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.450376][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.522301][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.560411][ T5717] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 227.579148][ T5710] scsi host1: usb-storage 2-1:0.0 [ 227.591958][ T5717] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 227.600098][ T5717] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 227.607937][ T5710] usb 2-1: USB disconnect, device number 41 [ 227.612147][ T9] rc_core: IR keymap rc-hauppauge not found [ 227.625082][ T9] Registered IR keymap rc-empty [ 227.630761][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.642025][ T5717] usb 3-1: USB disconnect, device number 32 [ 227.670515][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.721248][ T9] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1 [ 227.812026][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1/input44 [ 227.898559][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.931064][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.400736][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.420968][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.440568][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.460387][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.500340][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.530391][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.570305][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.640344][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.693581][ T9] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 228.725289][ T9] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 228.824305][ T8459] netlink: 'syz.1.757': attribute type 2 has an invalid length. [ 228.878157][ T8460] netlink: 'syz.1.757': attribute type 2 has an invalid length. [ 229.315789][ T9] usb 1-1: USB disconnect, device number 28 [ 230.093415][ T8472] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 230.120379][ T9] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 230.271620][ T9] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 230.279692][ T9] usb 1-1: config 0 has no interface number 0 [ 230.285892][ T9] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 230.296921][ T9] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 230.307102][ T9] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 230.316551][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.325800][ T9] usb 1-1: config 0 descriptor?? [ 230.640348][ T5611] kernel read not supported for file /dsp1 (pid: 5611 comm: kworker/0:3) [ 230.742664][ T9] usbhid 1-1:0.1: can't add hid device: -71 [ 230.767293][ T9] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 230.782854][ T9] usb 1-1: USB disconnect, device number 29 [ 230.990370][ T5738] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 231.000309][ T5611] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 231.140311][ T5738] usb 4-1: Using ep0 maxpacket: 32 [ 231.146558][ T5738] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 231.150285][ T5611] usb 3-1: Using ep0 maxpacket: 16 [ 231.154936][ T5738] usb 4-1: config 0 has no interface number 0 [ 231.159753][ T5717] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 231.166072][ T5738] usb 4-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 231.175129][ T5611] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 231.183570][ T5738] usb 4-1: config 0 interface 89 has no altsetting 0 [ 231.193678][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 231.201967][ T5738] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 231.220684][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 231.220956][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.230442][ T5611] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 231.238554][ T5738] usb 4-1: Product: syz [ 231.248314][ T5611] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 231.252355][ T5738] usb 4-1: Manufacturer: syz [ 231.265929][ T5611] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 231.269732][ T5738] usb 4-1: SerialNumber: syz [ 231.278691][ T5611] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 231.291572][ T5611] usb 3-1: Manufacturer: syz [ 231.291904][ T5738] usb 4-1: config 0 descriptor?? [ 231.297015][ T5611] usb 3-1: config 0 descriptor?? [ 231.306725][ T5738] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 231.326089][ T5738] em28xx 4-1:0.89: Video interface 89 found: [ 231.331452][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 231.345953][ T5717] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 231.360299][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 231.372274][ T5717] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 231.384480][ T5717] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 231.394274][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.402573][ T5717] usb 2-1: Product: syz [ 231.406863][ T5717] usb 2-1: Manufacturer: syz [ 231.411539][ T5717] usb 2-1: SerialNumber: syz [ 231.422194][ T5717] usb 2-1: config 0 descriptor?? [ 231.433660][ T5717] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 231.580587][ T5611] rc_core: IR keymap rc-hauppauge not found [ 231.586560][ T5611] Registered IR keymap rc-empty [ 231.592293][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.610349][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.630736][ T5611] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 231.643226][ T5717] scsi host1: usb-storage 2-1:0.0 [ 231.648522][ T5611] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input45 [ 231.664348][ T5717] usb 2-1: USB disconnect, device number 42 [ 231.672635][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.690368][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.711327][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.730370][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.750297][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.770326][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.790312][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.800473][ T9] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 231.810311][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.830313][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.850326][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 231.871153][ T5611] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 231.879200][ T5611] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 231.893678][ T5611] usb 3-1: USB disconnect, device number 33 [ 231.911014][ T5738] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 231.950354][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 231.956839][ T9] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 231.965131][ T9] usb 1-1: config 0 has no interface number 1 [ 231.971317][ T9] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 231.982326][ T9] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 231.994035][ T9] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 232.005374][ T9] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 232.015599][ T9] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 232.028938][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 232.040440][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 232.050197][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 232.062602][ T9] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 232.071796][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.079818][ T9] usb 1-1: Product: syz [ 232.084058][ T9] usb 1-1: Manufacturer: syz [ 232.088670][ T9] usb 1-1: SerialNumber: syz [ 232.094450][ T9] usb 1-1: config 0 descriptor?? [ 232.099889][ T8501] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 232.108773][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 232.117457][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 232.135432][ T9] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 232.350722][ T805] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 232.372831][ T5738] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 232.443252][ T5738] em28xx 4-1:0.89: board has no eeprom [ 232.540584][ T5738] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 232.553108][ T5710] usb 1-1: USB disconnect, device number 30 [ 232.562304][ T5738] em28xx 4-1:0.89: analog set to bulk mode. [ 232.573329][ T5702] em28xx 4-1:0.89: Registering V4L2 extension [ 232.591177][ T805] usb 3-1: Using ep0 maxpacket: 8 [ 232.603229][ T5738] usb 4-1: USB disconnect, device number 22 [ 232.622161][ T805] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 232.632764][ T5738] em28xx 4-1:0.89: Disconnecting em28xx [ 232.641669][ T5702] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 232.648623][ T805] usb 3-1: config 0 has no interface number 1 [ 232.659170][ T5702] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 232.669799][ T805] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 232.681514][ T5702] em28xx 4-1:0.89: No AC97 audio processor [ 232.690219][ T805] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 232.708456][ T5702] usb 4-1: Decoder not found [ 232.713358][ T5702] em28xx 4-1:0.89: failed to create media graph [ 232.719592][ T805] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 232.731141][ T5702] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 232.739403][ T5702] em28xx 4-1:0.89: Registering snapshot button... [ 232.745889][ T805] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 232.757381][ T5702] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input46 [ 232.768198][ T805] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 232.784361][ T5702] em28xx 4-1:0.89: Remote control support is not available for this card. [ 232.793318][ T805] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 232.804998][ T5738] em28xx 4-1:0.89: Closing input extension [ 232.812306][ T5738] em28xx 4-1:0.89: Deregistering snapshot button [ 232.818925][ T805] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 232.831154][ T5738] em28xx 4-1:0.89: Freeing device [ 232.836556][ T805] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 232.856156][ T805] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 232.868148][ T805] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.876797][ T805] usb 3-1: Product: syz [ 232.881155][ T805] usb 3-1: Manufacturer: syz [ 232.888305][ T805] usb 3-1: SerialNumber: syz [ 232.905817][ T805] usb 3-1: config 0 descriptor?? [ 232.923495][ T8505] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 232.945833][ T805] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 232.955369][ T805] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 232.987535][ T805] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 233.522888][ T805] usb 3-1: USB disconnect, device number 34 [ 233.601407][ T8532] FAULT_INJECTION: forcing a failure. [ 233.601407][ T8532] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.614657][ T8532] CPU: 0 UID: 0 PID: 8532 Comm: syz.1.779 Tainted: G L syzkaller #0 PREEMPT(full) [ 233.614683][ T8532] Tainted: [L]=SOFTLOCKUP [ 233.614689][ T8532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 233.614697][ T8532] Call Trace: [ 233.614701][ T8532] [ 233.614705][ T8532] dump_stack_lvl+0x100/0x190 [ 233.614721][ T8532] should_fail_ex.cold+0x5/0xa [ 233.614735][ T8532] strncpy_from_user+0x3b/0x2d0 [ 233.614750][ T8532] do_getname+0x78/0x390 [ 233.614761][ T8532] do_sys_openat2+0xc7/0x1e0 [ 233.614772][ T8532] ? __pfx_do_sys_openat2+0x10/0x10 [ 233.614784][ T8532] __x64_sys_openat+0x12d/0x210 [ 233.614794][ T8532] ? __pfx___x64_sys_openat+0x10/0x10 [ 233.614805][ T8532] ? rcu_is_watching+0x12/0xc0 [ 233.614821][ T8532] do_syscall_64+0x115/0x870 [ 233.614831][ T8532] ? clear_bhb_loop+0x40/0x90 [ 233.614843][ T8532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.614854][ T8532] RIP: 0033:0x7f82c7b5d68e [ 233.614862][ T8532] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 233.614873][ T8532] RSP: 002b:00007f82c5dd4f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 233.614883][ T8532] RAX: ffffffffffffffda RBX: 00007f82c5dd56c0 RCX: 00007f82c7b5d68e [ 233.614890][ T8532] RDX: 0000000000000000 RSI: 00007f82c7c325aa RDI: ffffffffffffff9c [ 233.614896][ T8532] RBP: 00007f82c5dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 233.614902][ T8532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.614908][ T8532] R13: 00007f82c7e16128 R14: 00007f82c7e16090 R15: 00007ffd831f8688 [ 233.614917][ T8532] [ 233.634052][ T8533] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 234.372277][ T8542] IPVS: dh: FWM 3 0x00000003 - no destination available [ 234.428210][ T8545] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8545 comm=syz.3.783 [ 234.458331][ T8545] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 234.620297][ T9] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 234.627932][ T5611] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 234.780295][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 234.785482][ T5611] usb 1-1: Using ep0 maxpacket: 8 [ 234.791816][ T5611] usb 1-1: config 0 interface 0 altsetting 22 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 234.804790][ T5611] usb 1-1: config 0 interface 0 has no altsetting 0 [ 234.811450][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.821542][ T5611] usb 1-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 234.830288][ T805] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 234.830633][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 234.848955][ T5611] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.857329][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 234.867539][ T5611] usb 1-1: config 0 descriptor?? [ 234.872677][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 234.882497][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 234.897801][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 234.906921][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 234.914969][ T9] usb 3-1: Manufacturer: syz [ 234.920733][ T9] usb 3-1: config 0 descriptor?? [ 234.990319][ T805] usb 5-1: Using ep0 maxpacket: 32 [ 234.996584][ T805] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 235.000318][ T5717] kernel read not supported for file /dsp1 (pid: 5717 comm: kworker/0:4) [ 235.004710][ T805] usb 5-1: config 0 has no interface number 0 [ 235.019270][ T805] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 235.029500][ T805] usb 5-1: config 0 interface 89 has no altsetting 0 [ 235.045125][ T805] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 235.059909][ T805] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.067972][ T805] usb 5-1: Product: syz [ 235.073255][ T805] usb 5-1: Manufacturer: syz [ 235.077861][ T805] usb 5-1: SerialNumber: syz [ 235.156929][ T805] usb 5-1: config 0 descriptor?? [ 235.168791][ T805] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 235.192182][ T805] em28xx 5-1:0.89: Video interface 89 found: [ 235.200313][ T9] rc_core: IR keymap rc-hauppauge not found [ 235.206304][ T9] Registered IR keymap rc-empty [ 235.213204][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.240391][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.260785][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 235.288299][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input47 [ 235.319556][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.555162][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.557695][ T8541] 9pnet: p9_errstr2errno: server reported unknown error [ 235.572131][ T8565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.586063][ T8565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.590282][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.634576][ T5611] hid_parser_main: 604 callbacks suppressed [ 235.634598][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x2 [ 235.648428][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.670077][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.680769][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.693536][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.707469][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.720289][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.730427][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.746520][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.762329][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.771899][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.785904][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.801374][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.810407][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.827888][ T5611] zydacron 0003:13EC:0006.000A: unknown main item tag 0x0 [ 235.846038][ T5611] zydacron 0003:13EC:0006.000A: unbalanced collection at end of report description [ 235.855500][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.877408][ T5611] zydacron 0003:13EC:0006.000A: parse failed [ 235.883598][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 235.891204][ T805] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 235.903929][ T5611] zydacron 0003:13EC:0006.000A: probe with driver zydacron failed with error -22 [ 235.917105][ T9] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 235.936236][ T9] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 235.975629][ T9] usb 3-1: USB disconnect, device number 35 [ 236.250469][ T5738] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 236.366394][ T805] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 236.377297][ T805] em28xx 5-1:0.89: board has no eeprom [ 236.410340][ T5738] usb 2-1: Using ep0 maxpacket: 8 [ 236.416637][ T5738] usb 2-1: config 0 has an invalid interface number: 151 but max is 1 [ 236.425086][ T5738] usb 2-1: config 0 has no interface number 1 [ 236.432302][ T5738] usb 2-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 236.443235][ T805] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 236.450484][ T5738] usb 2-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 236.462201][ T805] em28xx 5-1:0.89: analog set to bulk mode. [ 236.468198][ T5710] em28xx 5-1:0.89: Registering V4L2 extension [ 236.474807][ T5738] usb 2-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 236.490172][ T805] usb 5-1: USB disconnect, device number 28 [ 236.507196][ T805] em28xx 5-1:0.89: Disconnecting em28xx [ 236.513659][ T5738] usb 2-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 236.523891][ T5738] usb 2-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 236.543106][ T5738] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 236.557123][ T5738] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 236.567081][ T5710] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 236.578389][ T5710] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 236.587415][ T5738] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 236.597261][ T5710] em28xx 5-1:0.89: No AC97 audio processor [ 236.605174][ T5738] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 236.614335][ T5738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.622499][ T5710] usb 5-1: Decoder not found [ 236.627804][ T5710] em28xx 5-1:0.89: failed to create media graph [ 236.634128][ T5738] usb 2-1: Product: syz [ 236.638322][ T5738] usb 2-1: Manufacturer: syz [ 236.643030][ T5710] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 236.649749][ T5738] usb 2-1: SerialNumber: syz [ 236.655409][ T5710] em28xx 5-1:0.89: Registering snapshot button... [ 236.662584][ T5738] usb 2-1: config 0 descriptor?? [ 236.671209][ T5710] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input48 [ 236.682353][ T8571] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 236.683642][ T5710] em28xx 5-1:0.89: Remote control support is not available for this card. [ 236.699070][ T5738] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 236.708542][ T5738] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 236.718369][ T805] em28xx 5-1:0.89: Closing input extension [ 236.731400][ T805] em28xx 5-1:0.89: Deregistering snapshot button [ 236.743900][ T805] em28xx 5-1:0.89: Freeing device [ 236.752292][ T5738] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 236.909225][ T5738] usb 2-1: USB disconnect, device number 43 [ 237.020309][ T5611] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 237.182239][ T5611] usb 3-1: device descriptor read/64, error -71 [ 237.430403][ T5611] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 237.541029][ T9] usb 1-1: USB disconnect, device number 31 [ 237.643127][ T5611] usb 3-1: device descriptor read/64, error -71 [ 237.831404][ T5611] usb usb3-port1: attempt power cycle [ 237.951680][ T8588] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 238.200602][ T5611] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 238.248772][ T5611] usb 3-1: device descriptor read/8, error -71 [ 238.258590][ T8597] FAULT_INJECTION: forcing a failure. [ 238.258590][ T8597] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 238.271892][ T8597] CPU: 1 UID: 0 PID: 8597 Comm: syz.4.796 Tainted: G L syzkaller #0 PREEMPT(full) [ 238.271920][ T8597] Tainted: [L]=SOFTLOCKUP [ 238.271926][ T8597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 238.271937][ T8597] Call Trace: [ 238.271942][ T8597] [ 238.271948][ T8597] dump_stack_lvl+0x100/0x190 [ 238.271973][ T8597] should_fail_ex.cold+0x5/0xa [ 238.271996][ T8597] _copy_from_user+0x2e/0xd0 [ 238.272018][ T8597] copy_msghdr_from_user+0x9f/0x4c0 [ 238.272045][ T8597] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 238.272074][ T8597] ? __pfx__kstrtoull+0x10/0x10 [ 238.272089][ T8597] ? putname+0xb1/0x110 [ 238.272105][ T8597] ___sys_sendmsg+0x106/0x1e0 [ 238.272120][ T8597] ? __pfx____sys_sendmsg+0x10/0x10 [ 238.272139][ T8597] ? rcu_is_watching+0x12/0xc0 [ 238.272171][ T8597] __sys_sendmmsg+0x20c/0x440 [ 238.272194][ T8597] ? __pfx___sys_sendmmsg+0x10/0x10 [ 238.272215][ T8597] ? rcu_is_watching+0x12/0xc0 [ 238.272237][ T8597] ? ksys_write+0x190/0x250 [ 238.272266][ T8597] ? fput+0x79/0x100 [ 238.272280][ T8597] ? ksys_write+0x1ac/0x250 [ 238.272301][ T8597] ? __pfx_ksys_write+0x10/0x10 [ 238.272325][ T8597] __x64_sys_sendmmsg+0x9c/0x100 [ 238.272347][ T8597] do_syscall_64+0x115/0x870 [ 238.272363][ T8597] ? clear_bhb_loop+0x40/0x90 [ 238.272383][ T8597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.272400][ T8597] RIP: 0033:0x7fb272b9ce59 [ 238.272415][ T8597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.272431][ T8597] RSP: 002b:00007fb2739f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 238.272449][ T8597] RAX: ffffffffffffffda RBX: 00007fb272e15fa0 RCX: 00007fb272b9ce59 [ 238.272461][ T8597] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 000000000000000a [ 238.272471][ T8597] RBP: 00007fb2739f3090 R08: 0000000000000000 R09: 0000000000000000 [ 238.272481][ T8597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.272492][ T8597] R13: 00007fb272e16038 R14: 00007fb272e15fa0 R15: 00007ffe8f3d9ca8 [ 238.272508][ T8597] [ 238.530344][ T9] kernel read not supported for file /dsp1 (pid: 9 comm: kworker/0:0) [ 238.551338][ T5611] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 238.662518][ T5611] usb 3-1: device descriptor read/8, error -71 [ 238.830869][ T5611] usb usb3-port1: unable to enumerate USB device [ 238.941533][ T8605] netlink: 'syz.1.798': attribute type 2 has an invalid length. [ 238.992714][ T8607] netlink: 'syz.1.798': attribute type 2 has an invalid length. [ 239.180410][ T5738] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 239.663507][ T8616] random: crng reseeded on system resumption [ 239.730353][ T5738] usb 1-1: Using ep0 maxpacket: 8 [ 239.736909][ T5738] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 239.745490][ T5738] usb 1-1: config 0 has no interface number 1 [ 239.753948][ T5738] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 239.765041][ T5738] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 239.777002][ T5738] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 239.788669][ T5738] usb 1-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 239.799294][ T5738] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.859507][ T5738] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 239.871196][ T5738] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 25972, setting to 1024 [ 239.882418][ T5738] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 1024 [ 239.894022][ T5738] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 239.903175][ T5738] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.911216][ T5738] usb 1-1: Product: syz [ 239.982482][ T9] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 240.149623][ T5738] usb 1-1: Manufacturer: syz [ 240.164519][ T5738] usb 1-1: SerialNumber: syz [ 240.892018][ T5738] usb 1-1: config 0 descriptor?? [ 241.006835][ T8602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 241.016745][ T5738] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 241.036535][ T5738] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 241.161103][ T9] usb 4-1: config 43 interface 0 has no altsetting 0 [ 241.256929][ T9] usb 4-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82 [ 241.271026][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.286225][ T9] usb 4-1: Product: syz [ 241.291699][ T9] usb 4-1: Manufacturer: syz [ 241.297391][ T9] usb 4-1: SerialNumber: syz [ 241.342841][ T5738] usb 1-1: USB disconnect, device number 32 [ 241.387844][ T6951] udevd[6951]: setting mode of /dev/admmidi3 to 020660 failed: No such file or directory [ 241.403829][ T5600] udevd[5600]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 241.443852][ T6951] udevd[6951]: setting owner of /dev/admmidi3 to uid=0, gid=29 failed: No such file or directory [ 241.762629][ T9] usb 4-1: dvb_usb_v2: found a 'Anysee' in warm state [ 241.828522][ T9] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 241.884950][ T9] dvb_usb_anysee 4-1:43.0: probe with driver dvb_usb_anysee failed with error -22 [ 241.994966][ T9] usb 4-1: USB disconnect, device number 23 [ 242.876017][ T8653] netlink: 32 bytes leftover after parsing attributes in process `syz.1.813'. [ 242.876107][ T8655] netlink: 172 bytes leftover after parsing attributes in process `syz.3.814'. [ 242.938908][ T8660] netlink: 44 bytes leftover after parsing attributes in process `syz.1.816'. [ 243.007944][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 243.028936][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 243.047373][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 243.153014][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 243.185222][ T8668] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 243.290291][ T804] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 243.450270][ T804] usb 2-1: Using ep0 maxpacket: 32 [ 243.810378][ T5710] kernel read not supported for file /dsp1 (pid: 5710 comm: kworker/1:5) [ 243.820866][ T804] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 243.829262][ T804] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 243.849277][ T804] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 243.865374][ T804] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 243.907836][ T804] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 243.919692][ T804] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 243.932220][ T804] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 243.945332][ T804] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 243.954581][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.967107][ T804] usb 2-1: config 0 descriptor?? [ 244.114287][ T29] audit: type=1400 audit(1782040416.838:496): avc: denied { connect } for pid=8685 comm="syz.0.826" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 244.429274][ T8691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.455054][ T8691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.848108][ T8699] netlink: 172 bytes leftover after parsing attributes in process `syz.2.828'. [ 245.136554][ T804] usb 2-1: USB disconnect, device number 44 [ 245.599083][ T8716] tipc: Started in network mode [ 245.618432][ T8716] tipc: Node identity ee6c8e549968, cluster identity 4711 [ 245.637212][ T8716] tipc: Enabled bearer , priority 0 [ 245.666278][ T8716] syzkaller0: entered promiscuous mode [ 245.675891][ T8716] syzkaller0: entered allmulticast mode [ 245.690578][ T8716] tipc: Resetting bearer [ 245.706904][ T8715] tipc: Resetting bearer [ 245.826535][ T8715] tipc: Disabling bearer [ 247.110298][ T5611] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 247.125265][ T29] audit: type=1400 audit(1782040419.848:497): avc: denied { write } for pid=8742 comm="syz.0.842" name="mdstat" dev="proc" ino=4026532009 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_mdstat_t tclass=file permissive=1 [ 247.301180][ T5611] usb 3-1: Using ep0 maxpacket: 16 [ 247.440041][ T5611] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 247.465920][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 247.503825][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 247.534440][ T5611] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 247.545036][ T5611] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 247.562609][ T5611] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 247.571727][ T5611] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 247.579748][ T5611] usb 3-1: Manufacturer: syz [ 247.592181][ T5611] usb 3-1: config 0 descriptor?? [ 247.680450][ T24] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 248.360281][ T5611] rc_core: IR keymap rc-hauppauge not found [ 248.377342][ T5611] Registered IR keymap rc-empty [ 248.383074][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.420477][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.460780][ T5611] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 248.491435][ T24] usb 2-1: config 0 has no interfaces? [ 248.491573][ T5611] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input49 [ 248.509381][ T24] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 248.519041][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.519472][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.547039][ T24] usb 2-1: config 0 descriptor?? [ 248.560552][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.590318][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.600728][ T5738] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 248.620418][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.650320][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.700401][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.726611][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.733171][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.739916][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.746812][ T8769] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 248.750342][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.761020][ T8769] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 248.761063][ T8769] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 248.761841][ T8769] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 248.804565][ T8769] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 248.819090][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.826121][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.833189][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.840258][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.840337][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.847209][ T8769] netdevsim0 speed is unknown, defaulting to 1000 [ 248.878048][ T8748] FAULT_INJECTION: forcing a failure. [ 248.878048][ T8748] name failslab, interval 1, probability 0, space 0, times 0 [ 248.898638][ T8773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.907737][ T8748] CPU: 0 UID: 0 PID: 8748 Comm: syz.1.843 Tainted: G L syzkaller #0 PREEMPT(full) [ 248.907764][ T8748] Tainted: [L]=SOFTLOCKUP [ 248.907770][ T8748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 248.907780][ T8748] Call Trace: [ 248.907786][ T8748] [ 248.907792][ T8748] dump_stack_lvl+0x100/0x190 [ 248.907815][ T8748] should_fail_ex.cold+0x5/0xa [ 248.907836][ T8748] ? fs_reclaim_acquire+0x70/0x100 [ 248.907856][ T8748] ? tomoyo_realpath_from_path+0xb6/0x690 [ 248.907874][ T8748] should_failslab+0xc2/0x120 [ 248.907892][ T8748] __kmalloc_noprof+0xe0/0x840 [ 248.907914][ T8748] ? kfree+0x1e5/0x6c0 [ 248.907936][ T8748] tomoyo_realpath_from_path+0xb6/0x690 [ 248.907955][ T8748] tomoyo_path_number_perm+0x23c/0x580 [ 248.907979][ T8748] ? tomoyo_path_number_perm+0x22e/0x580 [ 248.908002][ T8748] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 248.908029][ T8748] ? preempt_count_add+0x76/0x150 [ 248.908053][ T8748] ? rcu_is_watching+0x12/0xc0 [ 248.908076][ T8748] ? __fget_files+0x215/0x3d0 [ 248.908100][ T8748] ? hook_file_ioctl_common+0x140/0x440 [ 248.908121][ T8748] ? lock_release+0x24d/0x310 [ 248.908140][ T8748] ? __fget_files+0x21f/0x3d0 [ 248.908164][ T8748] security_file_ioctl+0xd3/0x230 [ 248.908189][ T8748] __x64_sys_ioctl+0xb7/0x210 [ 248.908211][ T8748] do_syscall_64+0x115/0x870 [ 248.908226][ T8748] ? clear_bhb_loop+0x40/0x90 [ 248.908245][ T8748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.908262][ T8748] RIP: 0033:0x7f82c7b9ce59 [ 248.908275][ T8748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.908291][ T8748] RSP: 002b:00007f82c5df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 248.908314][ T8748] RAX: ffffffffffffffda RBX: 00007f82c7e15fa0 RCX: 00007f82c7b9ce59 [ 248.908325][ T8748] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000b [ 248.908334][ T8748] RBP: 00007f82c5df6090 R08: 0000000000000000 R09: 0000000000000000 [ 248.908344][ T8748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 248.908355][ T8748] R13: 00007f82c7e16038 R14: 00007f82c7e15fa0 R15: 00007ffd831f8688 [ 248.908372][ T8748] [ 248.908378][ T8748] ERROR: Out of memory at tomoyo_realpath_from_path. [ 248.918460][ T5738] usb 5-1: Using ep0 maxpacket: 16 [ 248.919357][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 248.931310][ T5738] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 248.943194][ T8773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.961673][ T5738] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 248.991026][ T5611] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 249.067223][ T5611] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 249.180049][ T5738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.199903][ T5738] usb 5-1: Product: syz [ 249.202579][ T5611] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 249.205253][ T5738] usb 5-1: Manufacturer: syz [ 249.217366][ T5738] usb 5-1: SerialNumber: syz [ 249.218521][ T5611] usb 3-1: USB disconnect, device number 40 [ 249.240457][ T5738] usb 5-1: config 0 descriptor?? [ 249.249694][ T804] usb 2-1: USB disconnect, device number 45 [ 249.315192][ T5738] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 249.331572][ T5738] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 249.600258][ T5611] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 249.761891][ T5611] usb 3-1: Using ep0 maxpacket: 32 [ 249.775711][ T5611] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 249.786574][ T5611] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 249.807123][ T5611] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.837980][ T5611] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 249.859981][ T5611] usb 3-1: config 1 has no interface number 0 [ 249.872640][ T5611] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 249.887338][ T5738] em28xx 5-1:0.0: chip ID is em2765 [ 249.891555][ T5611] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.915418][ T5611] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 250.000728][ T29] audit: type=1400 audit(1782040422.718:498): avc: denied { read } for pid=8789 comm="syz.3.854" path="socket:[20953]" dev="sockfs" ino=20953 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 250.050432][ T29] audit: type=1400 audit(1782040422.718:499): avc: denied { read } for pid=8789 comm="syz.3.854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 250.091040][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.097428][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.373209][ T5611] snd_usb_pod 3-1:1.1: set_interface failed [ 250.392149][ T5611] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 250.421582][ T5611] snd_usb_pod 3-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 250.483315][ T5611] usb 3-1: USB disconnect, device number 41 [ 250.511530][ T5738] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 250.551330][ T5738] em28xx 5-1:0.0: board has no eeprom [ 251.049084][ T8822] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 251.611267][ T8762] em28xx 5-1:0.0: reading from i2c device at 0x8 failed (error=-5) [ 251.670359][ T5738] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 251.678527][ T5738] em28xx 5-1:0.0: dvb set to bulk mode. [ 251.689893][ T24] em28xx 5-1:0.0: Binding DVB extension [ 251.771316][ T5738] usb 5-1: USB disconnect, device number 29 [ 251.856701][ T5738] em28xx 5-1:0.0: Disconnecting em28xx [ 252.128852][ T24] em28xx 5-1:0.0: Registering input extension [ 252.201411][ T5738] em28xx 5-1:0.0: Closing input extension [ 252.329514][ T5738] em28xx 5-1:0.0: Freeing device [ 252.493971][ T8839] netlink: 'syz.1.866': attribute type 2 has an invalid length. [ 252.547708][ T8840] netlink: 'syz.1.866': attribute type 2 has an invalid length. [ 252.571986][ T29] audit: type=1400 audit(1782040425.288:500): avc: denied { setopt } for pid=8831 comm="syz.3.864" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 253.231492][ T8845] FAULT_INJECTION: forcing a failure. [ 253.231492][ T8845] name failslab, interval 1, probability 0, space 0, times 0 [ 253.338091][ T8845] CPU: 0 UID: 0 PID: 8845 Comm: syz.0.865 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.338122][ T8845] Tainted: [L]=SOFTLOCKUP [ 253.338128][ T8845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 253.338139][ T8845] Call Trace: [ 253.338144][ T8845] [ 253.338151][ T8845] dump_stack_lvl+0x100/0x190 [ 253.338175][ T8845] should_fail_ex.cold+0x5/0xa [ 253.338196][ T8845] ? fs_reclaim_acquire+0x70/0x100 [ 253.338217][ T8845] ? tomoyo_encode2+0xfb/0x3c0 [ 253.338233][ T8845] should_failslab+0xc2/0x120 [ 253.338252][ T8845] __kmalloc_noprof+0xe0/0x840 [ 253.338275][ T8845] ? tomoyo_encode2+0x8e/0x3c0 [ 253.338292][ T8845] tomoyo_encode2+0xfb/0x3c0 [ 253.338309][ T8845] tomoyo_encode+0x29/0x50 [ 253.338324][ T8845] tomoyo_realpath_from_path+0x18c/0x690 [ 253.338344][ T8845] tomoyo_path_number_perm+0x23c/0x580 [ 253.338366][ T8845] ? tomoyo_path_number_perm+0x22e/0x580 [ 253.338389][ T8845] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 253.338411][ T8845] ? trace_sched_exit_tp+0x120/0x160 [ 253.338435][ T8845] ? __schedule+0x126e/0x6730 [ 253.338468][ T8845] ? rcu_is_watching+0x12/0xc0 [ 253.338492][ T8845] ? __fget_files+0x215/0x3d0 [ 253.338516][ T8845] ? hook_file_ioctl_common+0x140/0x440 [ 253.338536][ T8845] ? lock_release+0x24d/0x310 [ 253.338556][ T8845] ? __fget_files+0x21f/0x3d0 [ 253.338584][ T8845] security_file_ioctl+0xd3/0x230 [ 253.338611][ T8845] __x64_sys_ioctl+0xb7/0x210 [ 253.338633][ T8845] do_syscall_64+0x115/0x870 [ 253.338649][ T8845] ? clear_bhb_loop+0x40/0x90 [ 253.338669][ T8845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.338687][ T8845] RIP: 0033:0x7f5e7959ce59 [ 253.338701][ T8845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.338718][ T8845] RSP: 002b:00007f5e7a42a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 253.338737][ T8845] RAX: ffffffffffffffda RBX: 00007f5e79816090 RCX: 00007f5e7959ce59 [ 253.338749][ T8845] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 253.338759][ T8845] RBP: 00007f5e7a42a090 R08: 0000000000000000 R09: 0000000000000000 [ 253.338770][ T8845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.338780][ T8845] R13: 00007f5e79816128 R14: 00007f5e79816090 R15: 00007ffcfb15e978 [ 253.338797][ T8845] [ 253.592085][ T8845] ERROR: Out of memory at tomoyo_realpath_from_path. [ 253.600370][ T5738] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 253.922159][ T8849] syzkaller0: entered promiscuous mode [ 253.927647][ T8849] syzkaller0: entered allmulticast mode [ 254.064959][ T24] IPVS: starting estimator thread 0... [ 254.170684][ T8859] IPVS: using max 71 ests per chain, 170400 per kthread [ 254.210359][ T5738] usb 4-1: device descriptor read/64, error -71 [ 254.211407][ T8867] FAULT_INJECTION: forcing a failure. [ 254.211407][ T8867] name failslab, interval 1, probability 0, space 0, times 0 [ 254.229327][ T8867] CPU: 0 UID: 0 PID: 8867 Comm: syz.4.872 Tainted: G L syzkaller #0 PREEMPT(full) [ 254.229352][ T8867] Tainted: [L]=SOFTLOCKUP [ 254.229358][ T8867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 254.229367][ T8867] Call Trace: [ 254.229372][ T8867] [ 254.229378][ T8867] dump_stack_lvl+0x100/0x190 [ 254.229400][ T8867] should_fail_ex.cold+0x5/0xa [ 254.229420][ T8867] ? fs_reclaim_acquire+0x70/0x100 [ 254.229438][ T8867] ? tomoyo_encode2+0xfb/0x3c0 [ 254.229447][ T8867] should_failslab+0xc2/0x120 [ 254.229458][ T8867] __kmalloc_noprof+0xe0/0x840 [ 254.229475][ T8867] tomoyo_encode2+0xfb/0x3c0 [ 254.229484][ T8867] tomoyo_encode+0x29/0x50 [ 254.229493][ T8867] tomoyo_realpath_from_path+0x18c/0x690 [ 254.229505][ T8867] tomoyo_path_number_perm+0x23c/0x580 [ 254.229519][ T8867] ? tomoyo_path_number_perm+0x22e/0x580 [ 254.229533][ T8867] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 254.229550][ T8867] ? preempt_count_add+0x76/0x150 [ 254.229564][ T8867] ? rcu_is_watching+0x12/0xc0 [ 254.229578][ T8867] ? __fget_files+0x215/0x3d0 [ 254.229593][ T8867] ? hook_file_ioctl_common+0x140/0x440 [ 254.229605][ T8867] ? lock_release+0x24d/0x310 [ 254.229616][ T8867] ? __fget_files+0x21f/0x3d0 [ 254.229631][ T8867] security_file_ioctl+0xd3/0x230 [ 254.229646][ T8867] __x64_sys_ioctl+0xb7/0x210 [ 254.229659][ T8867] do_syscall_64+0x115/0x870 [ 254.229669][ T8867] ? clear_bhb_loop+0x40/0x90 [ 254.229681][ T8867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.229691][ T8867] RIP: 0033:0x7fb272b9ce59 [ 254.229700][ T8867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.229710][ T8867] RSP: 002b:00007fb2739d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 254.229721][ T8867] RAX: ffffffffffffffda RBX: 00007fb272e16090 RCX: 00007fb272b9ce59 [ 254.229727][ T8867] RDX: 0000200000000180 RSI: 00000000c0303e03 RDI: 0000000000000006 [ 254.229734][ T8867] RBP: 00007fb2739d2090 R08: 0000000000000000 R09: 0000000000000000 [ 254.229740][ T8867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 254.229746][ T8867] R13: 00007fb272e16128 R14: 00007fb272e16090 R15: 00007ffe8f3d9ca8 [ 254.229755][ T8867] [ 254.453169][ T8867] ERROR: Out of memory at tomoyo_realpath_from_path. [ 254.456321][ T8868] syzkaller0: entered promiscuous mode [ 254.465386][ T8868] syzkaller0: entered allmulticast mode [ 254.533314][ T5738] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 254.795561][ T8871] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 254.880359][ T5738] usb 4-1: device descriptor read/64, error -71 [ 255.088492][ T5738] usb usb4-port1: attempt power cycle [ 255.381520][ T5710] kernel read not supported for file /dsp1 (pid: 5710 comm: kworker/1:5) [ 255.452412][ T5738] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 255.710433][ T5738] usb 4-1: device not accepting address 26, error -71 [ 255.797736][ T8896] binder: BINDER_SET_CONTEXT_MGR already set [ 255.823418][ T8896] binder: 8895:8896 ioctl 4018620d 200000004a80 returned -16 [ 255.839241][ T8902] binder: BINDER_SET_CONTEXT_MGR already set [ 255.857537][ T8902] binder: 8901:8902 ioctl 4018620d 200000004a80 returned -16 [ 256.430887][ T8917] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 256.530494][ T8917] 9p: Bad value for 'wfdno' [ 257.330860][ T5717] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 257.380293][ T5738] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 257.412163][ T5738] usb 4-1: Using ep0 maxpacket: 8 [ 257.419170][ T5738] usb 4-1: config 0 has an invalid descriptor of length 112, skipping remainder of the config [ 257.644441][ T5738] usb 4-1: config 0 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 257.672966][ T5738] usb 4-1: config 0 interface 0 has no altsetting 0 [ 257.679620][ T5738] usb 4-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 257.679803][ T5717] usb 5-1: Using ep0 maxpacket: 16 [ 257.693727][ T5738] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.703563][ T5738] usb 4-1: config 0 descriptor?? [ 257.714389][ T5738] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 257.748926][ T8937] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 257.872390][ T5717] usb 5-1: unable to get BOS descriptor or descriptor too short [ 257.882344][ T5717] usb 5-1: no configurations [ 257.887114][ T5717] usb 5-1: can't read configurations, error -22 [ 258.446276][ T5738] kernel read not supported for file /dsp1 (pid: 5738 comm: kworker/1:8) [ 258.515738][ T29] audit: type=1400 audit(1782040431.238:501): avc: denied { bind } for pid=8950 comm="syz.0.894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 258.540008][ T8953] netlink: 64 bytes leftover after parsing attributes in process `syz.2.895'. [ 258.633969][ T29] audit: type=1400 audit(1782040431.258:502): avc: denied { write } for pid=8950 comm="syz.0.894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 258.665442][ T8958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.675954][ T8958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.685448][ T8960] IPVS: dh: FWM 3 0x00000003 - no destination available [ 258.779965][ T8958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.789099][ T8958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.006555][ T5611] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 259.201433][ T5611] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 259.211488][ T5611] usb 2-1: config 0 has no interface number 0 [ 259.218523][ T5611] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 259.231551][ T5611] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 259.241729][ T5611] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 259.251257][ T5611] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.261550][ T5611] usb 2-1: config 0 descriptor?? [ 259.843597][ T5611] input: HID 04d9:a055 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.1/0003:04D9:A055.000B/input/input51 [ 260.004548][ T5611] holtek_kbd 0003:04D9:A055.000B: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.1-1/input1 [ 260.029817][ T5717] usb 4-1: USB disconnect, device number 27 [ 260.069278][ T5611] usb 2-1: USB disconnect, device number 46 [ 260.173471][ T8979] fido_id[8979]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 261.139025][ T8992] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 261.318440][ T29] audit: type=1400 audit(1782040434.038:503): avc: denied { read write } for pid=9001 comm="syz.4.908" name="uhid" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 261.351156][ T5717] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 261.371554][ T5717] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 261.395200][ T29] audit: type=1400 audit(1782040434.038:504): avc: denied { open } for pid=9001 comm="syz.4.908" path="/dev/uhid" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 261.720413][ T5738] kernel read not supported for file /dsp1 (pid: 5738 comm: kworker/1:8) [ 262.256844][ T9022] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 262.260776][ T5717] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 262.294464][ T29] audit: type=1400 audit(1782040435.008:505): avc: denied { map } for pid=9015 comm="syz.0.913" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 262.355658][ T9023] FAULT_INJECTION: forcing a failure. [ 262.355658][ T9023] name failslab, interval 1, probability 0, space 0, times 0 [ 262.391198][ T29] audit: type=1400 audit(1782040435.008:506): avc: denied { execute } for pid=9015 comm="syz.0.913" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 262.420653][ T9023] CPU: 1 UID: 0 PID: 9023 Comm: syz.2.914 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.420680][ T9023] Tainted: [L]=SOFTLOCKUP [ 262.420685][ T9023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 262.420694][ T9023] Call Trace: [ 262.420698][ T9023] [ 262.420704][ T9023] dump_stack_lvl+0x100/0x190 [ 262.420726][ T9023] should_fail_ex.cold+0x5/0xa [ 262.420746][ T9023] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 262.420772][ T9023] should_failslab+0xc2/0x120 [ 262.420789][ T9023] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 262.420811][ T9023] ? mas_preallocate+0x1105/0x14a0 [ 262.420834][ T9023] mas_preallocate+0x1105/0x14a0 [ 262.420855][ T9023] ? __pfx_mas_preallocate+0x10/0x10 [ 262.420877][ T9023] ? anon_vma_name+0x5a/0x250 [ 262.420899][ T9023] __split_vma+0x33d/0xda0 [ 262.420923][ T9023] ? __pfx___split_vma+0x10/0x10 [ 262.420943][ T9023] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 262.420968][ T9023] ? unwind_get_return_address+0x59/0xa0 [ 262.420991][ T9023] ? arch_stack_walk+0xa6/0xf0 [ 262.421015][ T9023] vms_gather_munmap_vmas+0x1d2/0x1720 [ 262.421036][ T9023] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 262.421056][ T9023] ? mtree_range_walk+0x72b/0xb70 [ 262.421079][ T9023] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 262.421103][ T9023] ? mas_walk+0x6ef/0x9b0 [ 262.421128][ T9023] __mmap_region+0x4a7/0x2db0 [ 262.421150][ T9023] ? rcu_is_watching+0x12/0xc0 [ 262.421170][ T9023] ? __pfx___mmap_region+0x10/0x10 [ 262.421189][ T9023] ? __pfx___might_resched+0x10/0x10 [ 262.421205][ T9023] ? process_measurement+0x4c8/0x2350 [ 262.421221][ T9023] ? rcu_is_watching+0x12/0xc0 [ 262.421239][ T9023] ? process_measurement+0x4c8/0x2350 [ 262.421252][ T9023] ? lock_release+0x24d/0x310 [ 262.421267][ T9023] ? down_write+0x146/0x1f0 [ 262.421286][ T9023] ? process_measurement+0x1f4/0x2350 [ 262.421303][ T9023] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 262.421320][ T9023] ? __pfx_process_measurement+0x10/0x10 [ 262.421338][ T9023] ? avc_has_perm+0x135/0x1e0 [ 262.421354][ T9023] ? __pfx_avc_has_perm+0x10/0x10 [ 262.421371][ T9023] ? rcu_is_watching+0x12/0xc0 [ 262.421390][ T9023] ? unwind_next_frame+0x3be/0x2090 [ 262.421410][ T9023] ? rcu_is_watching+0x12/0xc0 [ 262.421430][ T9023] ? rcu_is_watching+0x12/0xc0 [ 262.421449][ T9023] ? is_bpf_text_address+0x8a/0x1a0 [ 262.421466][ T9023] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 262.421499][ T9023] ? do_raw_read_unlock+0x3f/0x70 [ 262.421520][ T9023] mmap_region+0x35d/0x620 [ 262.421542][ T9023] ? __pfx_mmap_region+0x10/0x10 [ 262.421564][ T9023] ? drm_gem_get_unmapped_area+0x17b/0x220 [ 262.421587][ T9023] ? selinux_mmap_addr+0x2b/0x110 [ 262.421607][ T9023] ? bpf_lsm_mmap_addr+0x9/0x30 [ 262.421626][ T9023] ? security_mmap_addr+0x71/0x1e0 [ 262.421640][ T9023] ? __get_unmapped_area+0x255/0x3e0 [ 262.421658][ T9023] do_mmap+0xc63/0x12f0 [ 262.421675][ T9023] ? __pfx_do_mmap+0x10/0x10 [ 262.421690][ T9023] ? __pfx_down_write_killable+0x10/0x10 [ 262.421707][ T9023] vm_mmap_pgoff+0x29e/0x470 [ 262.421725][ T9023] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 262.421741][ T9023] ? lock_release+0x24d/0x310 [ 262.421757][ T9023] ? __fget_files+0x21f/0x3d0 [ 262.421780][ T9023] ksys_mmap_pgoff+0x3cb/0x610 [ 262.421800][ T9023] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 262.421816][ T9023] ? fput+0x79/0x100 [ 262.421830][ T9023] ? ksys_write+0x1ac/0x250 [ 262.421850][ T9023] ? __pfx_ksys_write+0x10/0x10 [ 262.421873][ T9023] __x64_sys_mmap+0x125/0x190 [ 262.421896][ T9023] do_syscall_64+0x115/0x870 [ 262.421912][ T9023] ? clear_bhb_loop+0x40/0x90 [ 262.421932][ T9023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.421949][ T9023] RIP: 0033:0x7f74f719ce59 [ 262.421964][ T9023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.421981][ T9023] RSP: 002b:00007f74f80c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 262.421999][ T9023] RAX: ffffffffffffffda RBX: 00007f74f7416180 RCX: 00007f74f719ce59 [ 262.422011][ T9023] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 000020000002c000 [ 262.422022][ T9023] RBP: 00007f74f80c5090 R08: 0000000000000006 R09: 0000000100000000 [ 262.422032][ T9023] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 [ 262.422043][ T9023] R13: 00007f74f7416218 R14: 00007f74f7416180 R15: 00007ffe673615a8 [ 262.422059][ T9023] [ 263.128553][ T5717] usb 5-1: config 6 has an invalid interface number: 226 but max is 0 [ 263.149091][ T5717] usb 5-1: config 6 has no interface number 0 [ 263.170020][ T5717] usb 5-1: config 6 interface 226 has no altsetting 0 [ 263.236506][ T5717] usb 5-1: New USB device found, idVendor=1b3d, idProduct=0108, bcdDevice=67.9c [ 263.248793][ T5717] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.257535][ T5717] usb 5-1: Product: syz [ 263.261719][ T5717] usb 5-1: Manufacturer: syz [ 263.276021][ T5717] usb 5-1: SerialNumber: syz [ 263.520359][ T5611] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 263.775096][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 264.391000][ T5611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 264.401503][ T5611] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 264.414052][ T5611] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.691668][ T5611] usb 3-1: config 0 descriptor?? [ 264.715096][ T5717] ftdi_sio 5-1:6.226: FTDI USB Serial Device converter detected [ 264.724441][ T5717] ftdi_sio ttyUSB0: unknown device type: 0x679c [ 264.734551][ T5717] usb 5-1: USB disconnect, device number 32 [ 264.833232][ T5717] ftdi_sio 5-1:6.226: device disconnected [ 264.930104][ T9050] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 265.071860][ T9055] rdma_rxe: rxe_newlink: failed to add veth1_vlan [ 265.115525][ T5611] isku 0003:1E7D:319C.000D: unknown main item tag 0x0 [ 265.124686][ T5611] isku 0003:1E7D:319C.000D: unknown main item tag 0x0 [ 265.131892][ T5611] isku 0003:1E7D:319C.000D: item fetching failed at offset 2/7 [ 265.140671][ T5611] isku 0003:1E7D:319C.000D: parse failed [ 265.146635][ T5611] isku 0003:1E7D:319C.000D: probe with driver isku failed with error -22 [ 265.155138][ T5717] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 265.310329][ T5717] usb 5-1: Using ep0 maxpacket: 16 [ 265.316854][ T5717] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 265.327474][ T5717] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 265.334792][ T5710] usb 3-1: USB disconnect, device number 42 [ 265.340341][ T5717] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 265.356426][ T5717] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 265.367802][ T5717] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 265.387669][ T5717] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 265.400300][ T5717] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 265.408330][ T5717] usb 5-1: Manufacturer: syz [ 265.418982][ T5717] usb 5-1: config 0 descriptor?? [ 265.480969][ T5611] kernel read not supported for file /dsp1 (pid: 5611 comm: kworker/0:3) [ 265.595282][ T35] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.617621][ T35] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.631772][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.640628][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.701376][ T5717] rc_core: IR keymap rc-hauppauge not found [ 265.804715][ T29] audit: type=1400 audit(1782040438.528:507): avc: denied { map } for pid=9062 comm="syz.1.925" path="/dev/vhost-vsock" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 265.831025][ T5717] Registered IR keymap rc-empty [ 265.838347][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 265.848184][ T9066] IPVS: dh: FWM 3 0x00000003 - no destination available [ 265.861302][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 265.887222][ T5717] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 265.948222][ T5717] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input52 [ 266.009145][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 266.077689][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 266.567236][ T9074] netlink: 'syz.3.927': attribute type 2 has an invalid length. [ 266.610600][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 266.651032][ T9075] netlink: 'syz.3.927': attribute type 2 has an invalid length. [ 266.742303][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 266.891626][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.017538][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.131373][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.250668][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.327082][ T9080] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 267.370663][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.462289][ T5717] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 267.516747][ T9081] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 267.596434][ T5717] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 267.683350][ T5717] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 267.804385][ T5717] usb 5-1: USB disconnect, device number 33 [ 268.475289][ T804] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 268.691684][ T804] usb 3-1: Using ep0 maxpacket: 32 [ 268.732227][ T804] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 268.794173][ T804] usb 3-1: config 0 has no interface number 0 [ 268.813189][ T804] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 268.833405][ T804] usb 3-1: config 0 interface 89 has no altsetting 0 [ 269.042490][ T804] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 269.083989][ T804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.097911][ T804] usb 3-1: Product: syz [ 269.115553][ T804] usb 3-1: Manufacturer: syz [ 269.149253][ T804] usb 3-1: SerialNumber: syz [ 269.398296][ T804] usb 3-1: config 0 descriptor?? [ 269.420727][ T804] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 269.456056][ T804] em28xx 3-1:0.89: Video interface 89 found: [ 269.926250][ T29] audit: type=1326 audit(1782040442.338:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9111 comm="syz.4.937" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb272b9ce59 code=0x0 [ 270.163026][ T9121] IPVS: wrr: FWM 3 0x00000003 - no destination available: all destinations are overloaded [ 270.562016][ T804] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 271.132574][ T804] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 271.140766][ T804] em28xx 3-1:0.89: board has no eeprom [ 271.210335][ T804] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 271.219302][ T804] em28xx 3-1:0.89: analog set to bulk mode. [ 271.246591][ T5717] em28xx 3-1:0.89: Registering V4L2 extension [ 271.264331][ T804] usb 3-1: USB disconnect, device number 43 [ 271.294276][ T804] em28xx 3-1:0.89: Disconnecting em28xx [ 271.380120][ T5717] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 271.387393][ T5717] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 271.403621][ T5717] em28xx 3-1:0.89: No AC97 audio processor [ 271.610297][ T5625] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 271.616641][ T5613] Bluetooth: hci5: command 0x1003 tx timeout [ 271.747335][ T5717] usb 3-1: Decoder not found [ 271.752284][ T5717] em28xx 3-1:0.89: failed to create media graph [ 271.758622][ T5717] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 271.781469][ T5717] em28xx 3-1:0.89: Registering snapshot button... [ 271.788895][ T5717] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input53 [ 271.801823][ T5717] em28xx 3-1:0.89: Remote control support is not available for this card. [ 271.811011][ T804] em28xx 3-1:0.89: Closing input extension [ 271.816901][ T804] em28xx 3-1:0.89: Deregistering snapshot button [ 271.866959][ T804] em28xx 3-1:0.89: Freeing device [ 272.083520][ T9137] syz.4.944 (9137) used greatest stack depth: 19840 bytes left [ 272.223674][ T804] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 272.480612][ T804] usb 3-1: Using ep0 maxpacket: 8 [ 272.633805][ T804] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 272.742785][ T804] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 272.778180][ T804] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 272.808364][ T804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.833836][ T804] usb 3-1: Product: syz [ 272.847360][ T804] usb 3-1: Manufacturer: syz [ 272.866351][ T804] usb 3-1: SerialNumber: syz [ 273.070759][ T5710] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 273.261507][ T5710] usb 4-1: Using ep0 maxpacket: 16 [ 273.275180][ T5710] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 21, changing to 7 [ 273.475807][ T5710] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 273.534272][ T5710] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1088, setting to 1024 [ 273.620949][ T5710] usb 4-1: New USB device found, idVendor=0499, idProduct=1038, bcdDevice= 0.40 [ 273.650407][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.691937][ T5710] usb 4-1: Product: syz [ 273.714946][ T5710] usb 4-1: Manufacturer: syz [ 273.738544][ T5710] usb 4-1: SerialNumber: syz [ 273.750653][ T29] audit: type=1400 audit(1782040446.468:509): avc: denied { ioctl } for pid=9147 comm="syz.2.946" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x9424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 273.835311][ T804] usb 3-1: USB disconnect, device number 44 [ 273.986823][ T9172] netlink: 'syz.3.954': attribute type 8 has an invalid length. [ 274.050358][ T5738] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 274.086433][ T5710] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 274.093693][ T5710] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 274.113265][ T5710] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 274.130653][ T5710] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 274.151563][ T5710] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 274.178162][ T5710] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 274.203267][ T5710] usb 4-1: USB disconnect, device number 28 [ 274.227021][ T6885] udevd[6885]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 274.231249][ T5738] usb 2-1: Using ep0 maxpacket: 32 [ 274.272226][ T5738] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 274.285522][ T5738] usb 2-1: config 0 has no interface number 0 [ 274.300272][ T5738] usb 2-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 274.300329][ T804] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 274.320431][ T5738] usb 2-1: config 0 interface 89 has no altsetting 0 [ 274.333110][ T5738] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 274.360249][ T5738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.368273][ T5738] usb 2-1: Product: syz [ 274.380246][ T5738] usb 2-1: Manufacturer: syz [ 274.387205][ T5738] usb 2-1: SerialNumber: syz [ 274.404034][ T5738] usb 2-1: config 0 descriptor?? [ 274.422804][ T5738] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 274.441645][ T5738] em28xx 2-1:0.89: Video interface 89 found: [ 274.460576][ T804] usb 1-1: Using ep0 maxpacket: 8 [ 274.468927][ T804] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 111, changing to 7 [ 274.495157][ T804] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 274.515829][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.528011][ T804] usb 1-1: Product: ꔊᚖை跢㜅⠓Ȏࠦﾵ憶価荑䖂ප㌹ⴎ皣覕爬掿躩醞Ო妰⊾沭튩䉤䄴ﳌ贅鎏ᗡ፬䡣ᵢ恁湿鲖衛൹⦿ꢅ孟묘테蛊㿂仁ꋦ쾔쏇⣣ὰ牐燋䇢腭ꫩ잟屦坜᱒䣠㣚 [ 274.552403][ T804] usb 1-1: Manufacturer: ⠊ [ 274.557040][ T804] usb 1-1: SerialNumber: syz [ 275.082174][ T804] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 275.138796][ T804] usb 1-1: USB disconnect, device number 33 [ 275.208257][ T5738] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 275.838524][ T9223] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 276.017315][ T5738] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 276.047357][ T5738] em28xx 2-1:0.89: board has no eeprom [ 276.052171][ T804] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 276.120369][ T5738] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 276.180386][ T5738] em28xx 2-1:0.89: analog set to bulk mode. [ 276.230645][ T5710] em28xx 2-1:0.89: Registering V4L2 extension [ 276.344336][ T804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.358305][ T804] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 276.367970][ T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.392008][ T804] usb 5-1: config 0 descriptor?? [ 276.397190][ T5738] usb 2-1: USB disconnect, device number 47 [ 276.421590][ T5738] em28xx 2-1:0.89: Disconnecting em28xx [ 276.466803][ T5710] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 276.480423][ T5710] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 276.495844][ T5710] em28xx 2-1:0.89: No AC97 audio processor [ 276.511395][ T5710] usb 2-1: Decoder not found [ 276.529649][ T5710] em28xx 2-1:0.89: failed to create media graph [ 276.548607][ T5710] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 276.555509][ T24] kernel read not supported for file /dsp1 (pid: 24 comm: kworker/1:0) [ 276.591446][ T5710] em28xx 2-1:0.89: Registering snapshot button... [ 276.591600][ T9237] ================================================================== [ 276.605923][ T9237] BUG: KASAN: slab-use-after-free in v4l2_open+0x351/0x490 [ 276.613120][ T9237] Read of size 4 at addr ffff888052a48860 by task v4l_id/9237 [ 276.620548][ T9237] [ 276.622849][ T9237] CPU: 0 UID: 0 PID: 9237 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 276.622865][ T9237] Tainted: [L]=SOFTLOCKUP [ 276.622869][ T9237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 276.622875][ T9237] Call Trace: [ 276.622879][ T9237] [ 276.622884][ T9237] dump_stack_lvl+0x100/0x190 [ 276.622900][ T9237] print_report+0x13d/0x4b0 [ 276.622915][ T9237] ? __virt_addr_valid+0x239/0x430 [ 276.622928][ T9237] ? v4l2_open+0x351/0x490 [ 276.622943][ T9237] kasan_report+0xdf/0x1c0 [ 276.622956][ T9237] ? v4l2_open+0x351/0x490 [ 276.622972][ T9237] v4l2_open+0x351/0x490 [ 276.622987][ T9237] ? __pfx_v4l2_open+0x10/0x10 [ 276.623003][ T9237] chrdev_open+0x234/0x6a0 [ 276.623018][ T9237] ? __pfx_chrdev_open+0x10/0x10 [ 276.623033][ T9237] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 276.623046][ T9237] do_dentry_open+0x6ab/0x14d0 [ 276.623060][ T9237] ? __pfx_chrdev_open+0x10/0x10 [ 276.623076][ T9237] vfs_open+0x82/0x3f0 [ 276.623086][ T9237] path_openat+0x2873/0x4280 [ 276.623106][ T9237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.623118][ T9237] ? __pfx_path_openat+0x10/0x10 [ 276.623134][ T9237] do_file_open+0x20e/0x430 [ 276.623149][ T9237] ? __pfx_do_file_open+0x10/0x10 [ 276.623168][ T9237] ? alloc_fd+0x471/0x7a0 [ 276.623183][ T9237] ? do_getname+0x191/0x390 [ 276.623194][ T9237] do_sys_openat2+0x10f/0x1e0 [ 276.623204][ T9237] ? __pfx_do_sys_openat2+0x10/0x10 [ 276.623214][ T9237] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 276.623226][ T9237] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 276.623236][ T9237] ? lock_release+0x24d/0x310 [ 276.623248][ T9237] __x64_sys_openat+0x12d/0x210 [ 276.623259][ T9237] ? __pfx___x64_sys_openat+0x10/0x10 [ 276.623270][ T9237] ? rcu_is_watching+0x12/0xc0 [ 276.623285][ T9237] do_syscall_64+0x115/0x870 [ 276.623296][ T9237] ? clear_bhb_loop+0x40/0x90 [ 276.623307][ T9237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.623318][ T9237] RIP: 0033:0x7fa1744a7407 [ 276.623327][ T9237] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 276.623338][ T9237] RSP: 002b:00007fff42701570 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 276.623349][ T9237] RAX: ffffffffffffffda RBX: 00007fa174c61880 RCX: 00007fa1744a7407 [ 276.623356][ T9237] RDX: 0000000000000000 RSI: 00007fff42702f1c RDI: ffffffffffffff9c [ 276.623362][ T9237] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 276.623369][ T9237] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 276.623375][ T9237] R13: 00007fff427017c0 R14: 00007fa174dc8000 R15: 0000559f53e7e4d8 [ 276.623384][ T9237] [ 276.623388][ T9237] [ 276.887990][ T9237] Allocated by task 5710: [ 276.892286][ T9237] kasan_save_stack+0x30/0x50 [ 276.896944][ T9237] kasan_save_track+0x14/0x30 [ 276.901591][ T9237] __kasan_kmalloc+0xaa/0xb0 [ 276.906152][ T9237] em28xx_v4l2_init.cold+0x94/0x3a40 [ 276.911408][ T9237] em28xx_init_extension+0x13a/0x200 [ 276.916676][ T9237] request_module_async+0x61/0x80 [ 276.921671][ T9237] process_one_work+0xa23/0x1940 [ 276.926587][ T9237] worker_thread+0x5ef/0xe50 [ 276.931147][ T9237] kthread+0x370/0x450 [ 276.935198][ T9237] ret_from_fork+0x72b/0xd50 [ 276.939758][ T9237] ret_from_fork_asm+0x1a/0x30 [ 276.944495][ T9237] [ 276.946790][ T9237] Freed by task 5710: [ 276.950751][ T9237] kasan_save_stack+0x30/0x50 [ 276.955399][ T9237] kasan_save_track+0x14/0x30 [ 276.960045][ T9237] kasan_save_free_info+0x3b/0x70 [ 276.965043][ T9237] __kasan_slab_free+0x5f/0x80 [ 276.969791][ T9237] kfree+0x22b/0x6c0 [ 276.973668][ T9237] kref_put.isra.0+0x53/0x75 [ 276.978237][ T9237] em28xx_v4l2_init.cold+0x280/0x3a40 [ 276.983579][ T9237] em28xx_init_extension+0x13a/0x200 [ 276.988842][ T9237] request_module_async+0x61/0x80 [ 276.993846][ T9237] process_one_work+0xa23/0x1940 [ 276.998763][ T9237] worker_thread+0x5ef/0xe50 [ 277.003336][ T9237] kthread+0x370/0x450 [ 277.007380][ T9237] ret_from_fork+0x72b/0xd50 [ 277.011954][ T9237] ret_from_fork_asm+0x1a/0x30 [ 277.016708][ T9237] [ 277.019011][ T9237] The buggy address belongs to the object at ffff888052a48000 [ 277.019011][ T9237] which belongs to the cache kmalloc-8k of size 8192 [ 277.033048][ T9237] The buggy address is located 2144 bytes inside of [ 277.033048][ T9237] freed 8192-byte region [ffff888052a48000, ffff888052a4a000) [ 277.046985][ T9237] [ 277.049292][ T9237] The buggy address belongs to the physical page: [ 277.055672][ T9237] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52a48 [ 277.064404][ T9237] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 277.072885][ T9237] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 277.080409][ T9237] page_type: f5(slab) [ 277.084363][ T9237] raw: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 277.092932][ T9237] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 277.101507][ T9237] head: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 277.110150][ T9237] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 277.118795][ T9237] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 277.127446][ T9237] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 277.136095][ T9237] page dumped because: kasan: bad access detected [ 277.142485][ T9237] page_owner tracks the page as allocated [ 277.148169][ T9237] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7109, tgid 7107 (syz.3.391), ts 131653126492, free_ts 131641205688 [ 277.169249][ T9237] post_alloc_hook+0xfd/0x120 [ 277.173917][ T9237] get_page_from_freelist+0xf48/0x3530 [ 277.179358][ T9237] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 277.185227][ T9237] new_slab+0xa2/0x670 [ 277.189284][ T9237] refill_objects+0xe3/0x430 [ 277.193850][ T9237] __pcs_replace_empty_main+0x375/0x660 [ 277.199372][ T9237] __kvmalloc_node_noprof+0x809/0xa60 [ 277.204721][ T9237] tun_attach.isra.0+0x983/0x1870 [ 277.209722][ T9237] tun_net_init+0x416/0x560 [ 277.214200][ T9237] register_netdevice+0x685/0x25a0 [ 277.219294][ T9237] __tun_chr_ioctl+0x1ded/0x47c0 [ 277.224214][ T9237] __x64_sys_ioctl+0x18e/0x210 [ 277.228964][ T9237] do_syscall_64+0x115/0x870 [ 277.233528][ T9237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.239414][ T9237] page last free pid 4980 tgid 4980 stack trace: [ 277.245710][ T9237] __free_frozen_pages+0x79f/0x1090 [ 277.250881][ T9237] qlist_free_all+0x47/0xf0 [ 277.255361][ T9237] kasan_quarantine_reduce+0x1a0/0x1f0 [ 277.260807][ T9237] __kasan_slab_alloc+0x69/0x90 [ 277.265629][ T9237] __kmalloc_noprof+0x2ba/0x840 [ 277.270455][ T9237] tomoyo_realpath_from_path+0xb6/0x690 [ 277.275972][ T9237] tomoyo_path_perm+0x276/0x460 [ 277.280799][ T9237] security_inode_getattr+0x116/0x280 [ 277.286147][ T9237] vfs_fstat+0x4b/0xe0 [ 277.290195][ T9237] __do_sys_newfstat+0x8b/0x110 [ 277.295033][ T9237] do_syscall_64+0x115/0x870 [ 277.299614][ T9237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.305508][ T9237] [ 277.307816][ T9237] Memory state around the buggy address: [ 277.313424][ T9237] ffff888052a48700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 277.321457][ T9237] ffff888052a48780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 277.329495][ T9237] >ffff888052a48800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 277.337523][ T9237] ^ [ 277.344686][ T9237] ffff888052a48880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 277.352718][ T9237] ffff888052a48900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 277.360761][ T9237] ================================================================== [ 277.398203][ T5710] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input54 [ 277.415738][ T804] usbhid 5-1:0.0: can't add hid device: -71 [ 277.429644][ T804] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 277.441975][ T9237] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 277.449190][ T9237] CPU: 0 UID: 0 PID: 9237 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 277.459663][ T9237] Tainted: [L]=SOFTLOCKUP [ 277.463975][ T9237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 277.474024][ T9237] Call Trace: [ 277.477279][ T9237] [ 277.480195][ T9237] dump_stack_lvl+0x100/0x190 [ 277.484871][ T9237] vpanic+0x552/0x970 [ 277.488830][ T9237] ? __pfx_vpanic+0x10/0x10 [ 277.493307][ T9237] ? v4l2_open+0x351/0x490 [ 277.497699][ T9237] panic+0xd1/0xe0 [ 277.501418][ T9237] ? __pfx_panic+0x10/0x10 [ 277.505821][ T9237] ? v4l2_open+0x351/0x490 [ 277.510224][ T9237] ? preempt_schedule_common+0x42/0xc0 [ 277.515669][ T9237] ? check_panic_on_warn+0x1f/0x90 [ 277.520767][ T9237] check_panic_on_warn.cold+0x19/0x34 [ 277.526122][ T9237] end_report.part.0+0x3a/0x90 [ 277.530870][ T9237] kasan_report.cold+0xe/0x18 [ 277.535532][ T9237] ? v4l2_open+0x351/0x490 [ 277.539932][ T9237] v4l2_open+0x351/0x490 [ 277.544164][ T9237] ? __pfx_v4l2_open+0x10/0x10 [ 277.548911][ T9237] chrdev_open+0x234/0x6a0 [ 277.553312][ T9237] ? __pfx_chrdev_open+0x10/0x10 [ 277.558236][ T9237] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 277.564544][ T9237] do_dentry_open+0x6ab/0x14d0 [ 277.569290][ T9237] ? __pfx_chrdev_open+0x10/0x10 [ 277.574211][ T9237] vfs_open+0x82/0x3f0 [ 277.578261][ T9237] path_openat+0x2873/0x4280 [ 277.582849][ T9237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.588898][ T9237] ? __pfx_path_openat+0x10/0x10 [ 277.593827][ T9237] do_file_open+0x20e/0x430 [ 277.598315][ T9237] ? __pfx_do_file_open+0x10/0x10 [ 277.603329][ T9237] ? alloc_fd+0x471/0x7a0 [ 277.607662][ T9237] ? do_getname+0x191/0x390 [ 277.612146][ T9237] do_sys_openat2+0x10f/0x1e0 [ 277.616818][ T9237] ? __pfx_do_sys_openat2+0x10/0x10 [ 277.621995][ T9237] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 277.628389][ T9237] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 277.634782][ T9237] ? lock_release+0x24d/0x310 [ 277.639442][ T9237] __x64_sys_openat+0x12d/0x210 [ 277.644274][ T9237] ? __pfx___x64_sys_openat+0x10/0x10 [ 277.649629][ T9237] ? rcu_is_watching+0x12/0xc0 [ 277.654380][ T9237] do_syscall_64+0x115/0x870 [ 277.658952][ T9237] ? clear_bhb_loop+0x40/0x90 [ 277.663614][ T9237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.669501][ T9237] RIP: 0033:0x7fa1744a7407 [ 277.673894][ T9237] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 277.693481][ T9237] RSP: 002b:00007fff42701570 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 277.701874][ T9237] RAX: ffffffffffffffda RBX: 00007fa174c61880 RCX: 00007fa1744a7407 [ 277.709823][ T9237] RDX: 0000000000000000 RSI: 00007fff42702f1c RDI: ffffffffffffff9c [ 277.717771][ T9237] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 277.725721][ T9237] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 277.733671][ T9237] R13: 00007fff427017c0 R14: 00007fa174dc8000 R15: 0000559f53e7e4d8 [ 277.741626][ T9237] [ 277.744825][ T9237] Kernel Offset: disabled [ 277.749132][ T9237] Rebooting in 86400 seconds..