last executing test programs: 4m46.58137024s ago: executing program 1 (id=1274): syz_usb_connect(0x5, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x30, 0xf, 0x35, 0x8, 0x4da, 0x390d, 0x991a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x44, [{{0x9, 0x4, 0xef, 0x0, 0x0, 0x84, 0x6a, 0x92}}]}}]}}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={0x0}, 0x18) (fail_nth: 1) 4m43.932732441s ago: executing program 1 (id=1281): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005dc0)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001d40)="d8750288189987d0fabb09b2386777", 0xf}, {&(0x7f0000000040)="d7eca96a4596a9bc882d17c60e5ad0cf2b", 0x11}], 0x2}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/36, 0x24}, {&(0x7f00000006c0)=""/188, 0xbc}], 0x2}, 0x7}], 0x1, 0x10000, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002040)={&(0x7f0000001fc0)={0x24, 0x2, 0x3, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0xa}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x702}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x80) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) getsockname$tipc(r2, &(0x7f0000000440)=@id, &(0x7f0000000480)=0x10) syz_usb_connect$cdc_ncm(0x0, 0x82, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x2, 0x1, 0x78, 0x0, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "505da2"}, {0x5, 0x24, 0x0, 0x101}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x0, 0x7f}, {0x6, 0x24, 0x1a, 0x1a4}, [@obex={0x5, 0x24, 0x15, 0x30b}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x8, 0x9a, 0xc, 0x6, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0xf, 0xf3, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x9, 0x9, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x8, 0x6, 0x4}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x3, 0x9, 0x0, 0x0, 0xbf}, 0x30, &(0x7f0000000340)=ANY=[@ANYBLOB="050f300002aa003fff00c03f000000ff00000000000000c0ff0030c0ff000710020a83080000a3f08508d678a55aaf19"], 0x2, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x3c0a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x340a}}]}) sendto$inet(r0, &(0x7f0000000240)='\x00', 0x1, 0x0, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x141000, 0x0) ioctl$PTP_SYS_OFFSET(r4, 0x3d13, 0x0) r5 = openat$dlm_plock(0xffffff9c, &(0x7f0000000140), 0x202c03, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r5) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 4m40.850494354s ago: executing program 1 (id=1288): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) brk(0x400000ffc020) (fail_nth: 1) 4m40.316489789s ago: executing program 1 (id=1291): r0 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) io_setup(0x8, &(0x7f0000004200)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) write$binfmt_misc(r0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0\x00') ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="5400000000010104000000000000000016000000140018800800014000000006080003400000000708000c40000000010800074000000000080003400000340c14000480080001400000000008000340000000089af5049ed5d4532dda959ad336769d09be997d6ec84f179111987166b23dc0e0f8497212c3976a097f8ef88d37344afc3bb4013db2b6d62dff8a7ac3e4af88c880cc4245b1b82e68ee774c32ac1bcd"], 0x54}}, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r9 = dup(r8) r10 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r10, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x1}, 0xc) setsockopt$MRT6_DEL_MIF(r10, 0x29, 0xcb, &(0x7f0000000040), 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0x1, 0x70bd2b, 0x25dfdbf4, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20008}}, 0x20}}, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x13) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000040)=@x86={0xff, 0xed, 0x1, 0x0, 0x800, 0xc, 0x3d, 0x3, 0x2, 0x5, 0x9, 0x13, 0x0, 0x7, 0x4, 0xf9, 0x7, 0xba, 0x40, '\x00', 0x7, 0x4}) ioctl$KVM_SET_GUEST_DEBUG(r8, 0x4048ae9b, &(0x7f0000000280)={0xb0003, 0x0, [0x7, 0x0, 0x5, 0xe, 0x0, 0x8, 0x2, 0x7]}) r11 = openat$tun(0xffffff9c, &(0x7f00000001c0), 0xc0040, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8924, &(0x7f0000000240)={'veth0_to_team\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) ioctl$KVM_RUN(r9, 0xae80, 0x0) futex(&(0x7f0000000000), 0x7, 0x2, &(0x7f0000000340)={0x77359400}, &(0x7f0000000080)=0x4, 0x1) 4m39.303084166s ago: executing program 1 (id=1292): r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_adjtime(0x0, &(0x7f0000000180)={0xb770}) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='loginuid\x00') preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000100)=""/24, 0x18}, {0x0}], 0x2, 0x40, 0x4) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) utimes(&(0x7f00000001c0)='./file0\x00', 0x0) read$FUSE(r2, &(0x7f0000006340)={0x2020}, 0x2058) write$FUSE_LSEEK(r2, 0x0, 0x0) umount2(&(0x7f0000000180)='./file0\x00', 0xb) read$FUSE(r2, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) 4m39.047735184s ago: executing program 1 (id=1293): r0 = syz_open_dev$vim2m(&(0x7f0000000180), 0xe9, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000001c0)={0x9, 0x2, 0x1}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'BRTI'}}) openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x442, 0x0) 4m38.68176877s ago: executing program 32 (id=1293): r0 = syz_open_dev$vim2m(&(0x7f0000000180), 0xe9, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000001c0)={0x9, 0x2, 0x1}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'BRTI'}}) openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x442, 0x0) 9.696911518s ago: executing program 2 (id=2271): r0 = syz_io_uring_setup(0x4fd9, &(0x7f0000000140)={0x0, 0x0, 0x4, 0x1, 0x142}, &(0x7f00000001c0), &(0x7f0000000000)) unshare(0x2040600) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) readv(r1, 0x0, 0x0) r2 = epoll_create1(0x80000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sysvipc/sem\x00', 0x0, 0x0) lseek(r4, 0x4e5, 0x0) lseek(r3, 0x10, 0xd14da709040405b4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) 9.561382412s ago: executing program 2 (id=2272): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000001b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001180)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xbf}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008800}, 0x20004010) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010}, &(0x7f0000000040)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000140)=0xfffffffc, 0x0, 0x4) 7.641213363s ago: executing program 5 (id=2277): syz_open_procfs$namespace(0x0, &(0x7f0000007880)='ns/cgroup\x00') socket$nl_crypto(0x10, 0x3, 0x15) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYRES64=r1, @ANYRES64], 0x20) 7.583259823s ago: executing program 2 (id=2278): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd", 0xf) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005dc0)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001d40)="d8750288189987d0fabb09b2386777", 0xf}, {&(0x7f0000000040)="d7eca96a4596a9bc882d17c60e5ad0cf2b", 0x11}], 0x2}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/36, 0x24}, {&(0x7f00000006c0)=""/188, 0xbc}], 0x2}, 0x7}], 0x1, 0x10000, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000900)=@newtclass={0x24, 0x28, 0x110, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x6, 0x9}, {0xffe0, 0xfff1}, {0x3, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x40) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002040)={&(0x7f0000001fc0)={0x24, 0x2, 0x3, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0xa}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x702}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x80) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) getsockname$tipc(r2, &(0x7f0000000440)=@id, &(0x7f0000000480)=0x10) syz_usb_connect$cdc_ncm(0x0, 0x82, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x2, 0x1, 0x78, 0x0, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "505da2"}, {0x5, 0x24, 0x0, 0x101}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x0, 0x7f}, {0x6, 0x24, 0x1a, 0x1a4}, [@obex={0x5, 0x24, 0x15, 0x30b}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x8, 0x9a, 0xc, 0x6, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0xf, 0xf3, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x9, 0x9, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x8, 0x6, 0x4}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x3, 0x9, 0x0, 0x0, 0xbf}, 0x30, &(0x7f0000000340)=ANY=[@ANYBLOB="050f300002aa003fff00c03f000000ff00000000000000c0ff0030c0ff000710020a83080000a3f08508d678a55aaf19"], 0x2, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x3c0a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x340a}}]}) sendto$inet(r0, &(0x7f0000000240)='\x00', 0x1, 0x0, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x141000, 0x0) ioctl$PTP_SYS_OFFSET(r4, 0x3d13, 0x0) r5 = openat$dlm_plock(0xffffff9c, &(0x7f0000000140), 0x202c03, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r5) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 7.555405164s ago: executing program 4 (id=2279): clock_gettime(0xfffffffffffffffb, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001c4ca8510480b0d30cdd40000000109021200010a0080000904a50000396e0300"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a010400000000000000000200000034000580300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c00028008000180ffffffff0900010073797a30000000000800020073797a320000000014000000110001"], 0x88}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_DELSET={0xa0, 0xb, 0xa, 0x301, 0x0, 0x0, {0x3}, [@NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @masq={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_MASQ_REG_PROTO_MIN={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xd}]}}}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x86}, @NFTA_EXTHDR_DREG={0x0, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x100}]}, @NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_SET_EXPRESSIONS={0x34, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x16}]}}}, {0x7, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x108}]}], {0x14}}, 0x118}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binfmt_register(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00'}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000000140)={0x1d, r3}, 0x10) sendmsg$can_bcm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) close(r2) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@getchain={0x24, 0x65, 0xfcd66a900070b049, 0x0, 0x3, {0x0, 0x0, 0x0, r7, {}, {}, {0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x55}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000400)={'tunl0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x0, 0x20, 0x3e, 0x8, {{0x1a, 0x4, 0x0, 0x15, 0x68, 0x65, 0x0, 0x85, 0x29, 0x0, @rand_addr=0x64010102, @remote, {[@timestamp_addr={0x44, 0x34, 0x6f, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@local}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x101}, {@private=0xa010102, 0x1}, {@local, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}]}, @rr={0x7, 0x1f, 0x75, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @broadcast, @remote, @multicast1, @multicast2, @remote]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@ipv6_getroute={0x60, 0x1a, 0x300, 0x70bd2b, 0x25dfdbfe, {0xa, 0x14, 0x10, 0xc, 0xfd, 0x3, 0xc8, 0x8, 0x200}, [@RTA_MARK={0x8, 0x10, 0x6}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_OIF={0x8, 0x4, r8}, @RTA_GATEWAY={0x14, 0x5, @loopback}, @RTA_OIF={0x8, 0x4, r3}, @RTA_PRIORITY={0x8, 0x6, 0x9}]}, 0x60}}, 0x40) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r9 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r9, 0x29, 0x2a, &(0x7f0000000080)={0x3, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e24, 0x0, @remote}}}, 0x104) setsockopt$inet6_group_source_req(r9, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x104) setsockopt$inet6_group_source_req(r9, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x5a50afdb, @mcast1={0xff, 0x7}, 0x5}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, 0x104) syz_usb_connect(0x3, 0x916, &(0x7f0000000b40)=ANY=[@ANYBLOB="120100027c8839200304aad9c0d20102030109020409030905c0050904cff206223141fd07240108080400072401060705000e240202710503004bb84b0ffb390c2402014001ff0599f366fa09050203000402078107250100010700090502020000aa00fa4b01f86784fe4e2a5ae273f21ab802df5647ff0aea7cb8cc0c5618a0dfa2d6c2e20d187920395f195fd77e0ba15481594ba27b077ac8189023dd3ec2513e52f6539be06010b8ef70849ab509050f011000044509de22f58f12321d053dfc4eb53ef7a60b18310260da1d523d5353acb394d951a00d6acdf721ce5855c8488220cf085dc4faf810a0959bdb86d759e248f413b90e267a10cd88b6101ca1ed671edc0bbee3ca90bd1dca2d96e1b8f0c4df3d66f6a811fb5e7b741780f7a5b0a008cd3fc4dd1eb86fdeaf471f23fa20a2e8cdb4c6cc9ed2f3f568d01a7f5c9d05c238e0a02ccd6bbf75bb5f4b52e467d64557846747772e98912cfc0d481cafb8c9ab2eed9baa2a2965193c97f6a0b16a720eddd9ab608e5181a62534211222a9fb2fd60ae5c442f355e26ca9d74698f15ea8ff0905051a000401d9fe0725010000040009050a004000000209dc03fbea2c12c90c8d4b5f40400bec3e7f0941b52abfba36c91fbe629cf7f9de25085ddee7b2c6d69bc1e4f1bc1cf8ca476e77ad7173c9b85fd4db967d0253c3d18d866ac929aa678813abaf701b0938ef40a95b3615865caa61b3389f1d1dda68de0bf78c6b35e23d80513345a83f0b877b27155b8bc9e2e9c873912852b9764010cec95c979ceb551a130a6c3c1ef61dd751165765bb44fd069e31fb3405aa9a17cd9d28c88104e3eac52cfd5cbb495343ddb081c026305373bd2322c8fbfb4bca9106431d8ab08d8d8702ce8da12948e5caff04a4f4f790bb44140905031020008108000725018000070009043b050872abff08052406000005240003000d240f0105000000a209050001052415080006240600006805240082fa0d240f010900000007000100ec05240102f90524150f000424020c09050d0c2000cd090907250103100700780274758b54da7f40ebf89e70dff9ffa2aabeccf32460650708fce3cff4229b6a61ae2e1bf3abee0aff2116c79df3c0914ff96ae9a6657e4c6fbb5e75d29439b6c416b349dce07a03a176d6b099329c29f544f81add956885ea2e050850d14df3a67cfd4af1cde8b54f22ccb6780b18f005a4b27ea7e4600905801c4000a80202072501010601f009050100200008058d0725010104251509050b0100b200108107250102073376090580000004010209770838cafc056265dc5bc4a492f18d83ff1583bd331b75373c6258bd5a66b321d2fc9c20bd2a84629d06030defbf4bbe3ff465a8076ec808b8b6d19acfbd4e246bfa71fc96dd5950c1331e2793d698e8b9f416c44634502c97ac57c31a87aa4482a32bd5ef4917e6d8d80cd3e2e60425c57125374ba6661252a23f247f4df2eb150905340008000907060725018006180007250180360000090508100002400904871146e01fb1e7bee2490c7951070e62aaa29cb12b6b10b0a5ff1008a098228c1e1cba57d7a248de107ce3acdd10be71689b16689d61f98bd14f5623c435d9334c0c826794ac922b87db29ac26d71b61a82322d27c0003af9a7e18b16454cbaf106bacd7add93247bbfef04f11d282e19709d0bbb4b706c6a0260296fe2898d419ffe018fe6a280725010206ff0309050000ff0309040007250101070c000904010710b94319060921000007012203051224020222000500a139de3af14ba122c760102402020900040007325e36dfc21be50e24020106030909c01b67fa2c6807240103020210090580030002073d020725010200050007250100070800090505000800fe0301072501830427700905082b0000071001bd0c3451ce32b812b9a7d662a29e9be8178432063414e88a2a34b2c76fd1d9e755a305abf49158701f79f4fa056dc3b44d4f47f1023a229566172e4e7cb25023bc2b2a4aecd5e0b1cc58835399d1110f3cd412938aa195f50726a216ce07db1d459a1f540205a726464c37235b65838e79e41c48a947ea4cf3efa8c0cbb9d0f003e64c6adca9f75fd96a1aac90dab5a2297bf52535ccfb93ee74d2c147bd81aa618e3a13f163f30e9bfad44e566fd6ba22218695ad968b23577834477509050f0310000603080725010105000007250102f9140809050c104000fe00000725018008070009050e270002010908072501000b05003604267af13d8d3d3704c7a9f98667ed398a6739923406d90fbdf58d1a91b19618e88781c5c2ba3db939ae93dd06ebcfdd233fd034830905070200040702011506ef0f72a24a5411fe670e9e4232bad7379a531209050f0010040e0501072501820308000725018004090009050c040004fe0309072501c3010400090502011000050280f830b086b8bcbafe5589a1dfffd8d98eb098852c321b15469a36b811681421621ef2a510a43627cc8e3f54a958bbdaf9a2360733b50648300ec02e41bb31d814443e9ede4385d029565cc3dc0a6672ae4575c828f26bfd4f05c0ba04650592e33b365c54c50686e364575938b5ecab9d157b3f74aa99f923aacf12048f0dbe683aa79f6db39a373d92539bea32ca9aed6cf863ac36e0cbd410e2d1845530c2b9063b0ee146d5a35d61bb84b9a3e97ce0914b69253d17bb7a8a6dc55c8cf45bd30fd22bc3a7dedf72864d4ee6a7fc016b185d60928b7288831821287b93c52d9ef04fe9849b92377e686b4a7bb23679ce63359e92c18d232d09050e000004056206957b28a71e5f91ff40d9485df919b836211db3fcbb490a6c76c365f7bdbf5ca2becbcd91e15c8283f3289ef56c406e82c242c6085179266539fe68e8ce2aa522d82914a603622fd6ef34f62b0d52ef181600964414058b4b61970615aace8388afea09807a3c9effe7a3d3d2c80d661dac2ec644b139ade957dca22e16e09d4a60c9e67f1d300b85fcb06b1aa9d67fc5fc7221cd1eacc28650d3d5378f1cb85925359007250102080700090580042000012a030931c19e3c444b779909050d0800040503030725010106f7ff0905011020000004070725018303000009050200400006000807250180050300090503010002bf450560233f363c44ff3243a107d8947b63228baf433ed28695dc735e8a3b2286fa99e88c6fa2b9c6286ff809254b809dc756cdbca38c3b4470eeb50a43ed83515d79c6ad27ec79b3a20b19a22d901d90f8b5dc8410f88d724c269cfbefa660c29cf6e1a9245d12fe1e2ba6c5163db835c7027d0c890559d59c6873356c5d4f3046eb0da126ffdbe2e5b36bc1fb87ec708c5161c8b9a49506cf0c95a66bc4105f1da71eb138192717d6d2b52da545b7a35c92ed508e680a0c655be0"], &(0x7f0000000100)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x201, 0xc, 0x6b, 0x1, 0x10, 0x18}, 0x16, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000062701800a1003000000c7080200"], 0x1, [{0x58, &(0x7f0000000580)=ANY=[@ANYBLOB="58037d4ce28245f3ff033816756a6e129ee66f71ac6b527d62b86e5ccf3f97595c943bce4a369d5c23194ca7626b23317c0eaa894d516e216667d4dd962124c4385ede5b6b438f33184943384bec9907af8323b659e9a0095eec382e"]}]}) 7.553964565s ago: executing program 3 (id=2289): fsopen(&(0x7f0000000040)='affs\x00', 0x1) r0 = fsmount(0xffffffffffffffff, 0x0, 0xff) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x0, 0x0, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r3, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r3, 0x0, 0x0) process_mrelease(r0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000000)="7541c3da99") 7.377138323s ago: executing program 5 (id=2280): r0 = io_uring_setup(0x696a, &(0x7f00000002c0)={0x0, 0x0, 0x40, 0x2, 0x331}) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, &(0x7f0000000340)=[@ioring_restriction_register_op, @ioring_restriction_sqe_flags_allowed, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_op], 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0xff, 0x3}, 0x20) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r4, &(0x7f0000002640)=""/4107, 0x100b, 0x535) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r8, 0x0, 0x8ec3, 0x0) splice(r7, 0x0, r2, 0x0, 0x2008484c, 0xb) write$nbd(r8, 0x0, 0x1010) write$binfmt_elf64(r6, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000080)={0x8, &(0x7f0000000040)=[{0x1, 0x81, 0x8, 0x65df}, {0xfff, 0x3, 0x6, 0x7}, {0x2, 0xff, 0xe, 0x1ff}, {0x8, 0x3, 0x9, 0x1}, {0x1, 0x1, 0x0, 0x15}, {0x8, 0x9, 0x9, 0x7ff}, {0x4, 0x1, 0x1, 0x9}, {0x3ff, 0x7, 0xfe, 0x100}]}, 0x8) 6.714844171s ago: executing program 5 (id=2281): fsopen(&(0x7f0000000040)='affs\x00', 0x1) r0 = fsmount(0xffffffffffffffff, 0x0, 0xff) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r2, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r2, 0x0, 0x0) process_mrelease(r0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000000)="7541c3da99") 6.001532408s ago: executing program 3 (id=2283): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="020200020b0000000000000000000000010b080000000000020001000014000000000588000000a0030006000000000002000000ac1414ff00000000000020000300050000000000020000000000000000000000f9a094eb41c8f1bf7dba0308e34e775197832fa7ff8bd666b2295a346f37f8cbc3043a947bf20df98bbc11a21b0f0105b0b7d917941965cb00"/152], 0x58}, 0x1, 0x7}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x8000, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100), 0xd79, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000002500)={{0x2, 0x4e21, @multicast2}, {0x6, @multicast}, 0x1c, {0x2, 0x4e21, @remote}, 'veth0\x00'}) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000000000)=0x40000001, 0x40000001) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r5, &(0x7f0000002280)=[{&(0x7f0000002180)=""/18, 0x12}, {&(0x7f0000002840)=""/231, 0xe7}], 0x2, 0x10001, 0x7) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) write$nci(r5, &(0x7f0000000080)=@NCI_OP_RF_DEACTIVATE_RSP={0x1, 0x0, 0x2, 0x6, 0x6}, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x1df) socket$inet_tcp(0x2, 0x1, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0) 5.900424241s ago: executing program 3 (id=2284): r0 = gettid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x101502) dup2(r3, r3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00ffff0806010200000000000800000000ffff04000780090052feea035bb594c2020073797a3100000000"], 0x2c}}, 0x40c0080) read$FUSE(r4, &(0x7f0000002140)={0x2020}, 0x2020) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000080)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffd, 0x0, 0x0, @void, @value, @void, @value}, 0x50) syz_open_dev$media(&(0x7f0000000000), 0x2ec4, 0x0) close(0xffffffffffffffff) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='attr\x00') getdents(r6, &(0x7f00000000c0)=""/20, 0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) io_setup(0xbb, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c000000040a0300000000000000000002000008090001"], 0x2c}, 0x1, 0x0, 0x0, 0x48840}, 0x0) futex(0x0, 0x85, 0x8, 0x0, 0x0, 0xffffff01) 5.791168531s ago: executing program 4 (id=2285): prctl$PR_SET_NAME(0xf, 0x0) r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='.#&-%)(%.\x00') sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000640)=@newqdisc={0xc8, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000001}]}]}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x16, 0x5, 0x1, 0x5, 0x0, 0xffffffff, 0x7fffffff}}, {0x4}}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 5.408613376s ago: executing program 4 (id=2286): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000a00)='wsync', &(0x7f0000000b40)="b2", 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000001380), 0x2, 0x501) write(0xffffffffffffffff, &(0x7f0000000040)="1c00000021002551071c0165ff00", 0xe) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000f40)={{0x14}, [@NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}]}], {0x14}}, 0x68}}, 0x0) socket$inet6(0xa, 0x6, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)={0xfffffffffffffffd, 0x1}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfeb4}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000bc0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d288168eda8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f117bdfe457f75e6f8200600f1a0e0f7643ba55fb18556858d4a4245b1e6caeeb0e52d05c3cb05983f295f1aae214d997a89a73e05534fddfde6271facada8f73b800845f8771c1e137412d98a2ad0844fbb3333c33a2884d6612424f96c337de938711ef7b9e98647a6b1aab208f998f96d9b3193ec72a89231e1acf6c4313bc6e45eff28305127bb773c2da0dcecf671a29647fac07844794", 0x169}, {&(0x7f00000002c0)="ce7ccd2d2c944169dc2b5dc4d1ffa850037245431cc5946071313f750701a08961f7fd07f408eb9136351299f22ffc3dfcc5343fa0f2", 0x36}, {&(0x7f0000000880)="8409220927e07db54a2722fa855b95004eb46eaeea27299765f609fd9a87344a8aaeb4b0aaba401545a2ec1fcc4239a328173fdb7698d2b055debc3ddbf4399afcd6838e8cdb5932b5f09863bf1f794b2ddce1b43cf8f1f7a251e276374f4846610ef2659c918492a7beddeb614e8f3d1680aac2a6dd735b00f3185535a2023e92a8514bd3f6b3e143ebc13026046616fa087bc64d0ce6210f09209c554b7edc302c4006db6fcd8fe1b310bd4f7b8ef216a5aea03173517f67a402c81fde4fa30076dc00f50faea04a8960a2e63fbd0841f0f5748907b5b959e3e9e0923e1030"}, {&(0x7f0000000300)="1179189127c144acffec4d"}, {&(0x7f0000000340)="b957851c8f100096878ec4adc3a1"}], 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="0000fb89962661651b7bcc94da7bd7e8cb00001701000003000000010000000000000017010000040000000500000000000000170100000200000000000000f4557afeb0e1196f866757ac4f155f716d514ac4e5d301a9052d59c559dd36c195ab00000000000017010000040000001ff700000000000017010000030000000100000000"]}], 0x1, 0x24040881) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) 4.746762757s ago: executing program 5 (id=2287): syz_open_procfs$namespace(0x0, &(0x7f0000007880)='ns/cgroup\x00') socket$nl_crypto(0x10, 0x3, 0x15) socket$inet6_tcp(0xa, 0x1, 0x0) pipe2$9p(&(0x7f0000000200), 0x4000) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x20) 4.57642288s ago: executing program 0 (id=2288): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x2b3940) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f00000000c0)={{r0}, "482789fc72ba69d5cde39b201ca9eccb60e9f108c3b81d7983de23a63b3d712c6babfd364d370f772fb2a9d80d55b5542c7ee5af3d435a9771d4d950b53c3ebcd2c53d3e9beef0d62b5a34c1d8c6fb448acff909085e5a8e365a4c51eedbab55a99e012b548ce78bbb6157037c505c39762bb66bc102f94ed5234533f5c1a9f8d427a08b43e5910a0358b0abee0a83b1b81063c175d5f60f3d59737511466a68def9dc5bdeded19829bb2d5e7d1b676c8f31beb7d44dc3dfed29c73e18633213787d4cb515bb18a05bb214109c55da8dca817a49bf34f94b21578078e403081eb6d52096395169355bc7db57becb2fe16e8d706b2de33524d06604c867d35dc18850742d6b5711caaaee7063c93b6ba6f017c5bdd682b03371d0187bdffb0e2340e58e532e4a2cef5002fb3d74599baa6b71556c3e9f1e17120a205f4407b8c6e553437362a1fc6c7b3607d71db2be46be1524e12731cac1bd400fa5ccd626caeb23f415e8560096ce373ff7ee8b7196f9d6d2c263d9926474084b4ac515090ca2e948246f1d9f7bb34dc8b222865de3d9509c48bc9247f17ea4c14281926bdb51211ee0697f912011d541100fd138ee6729c0585bec5b3eeebbffe117144d197b63d7037a1d949afcd13148fa9592d44e864bbbb4546447a550f06085539cb8e649f2530a0be01bcf95ec7d60720ac7d75e94791a0e38d1ea927b53546cb156b0a71715c3f60674535d93f744f976d1f3ac7eca62aaa310c99b785274da78edc98cb178aa2213ebc096adcbf7e2fe890786e9baf3c1ae5c647d00ae1596b20308134357af243a0a9c434663dada1c999b1fb50dc00103d53c2e60bdcba69b066e4712979b900697a559612b4fb9a187b4dd2bb8cd05cf8475f2dd7a3560b8dd41f60c20fa7251c1161de1589f7b6a358a87988567c9b4104f8c9d7dee604230a8168f3737ac69724cb36599097dd7f6ab4b2a273fc30ec87a5e262febbb27e28c695414e5437816a046be7b31734ec34431cf9806746b69be4204270aa48d66fcef118ea0465e679f56fbde6b090455c84a0b6828011a1e74430bfec4cadae9c0b4ba7358eca7628c18f1f96fbcd940876e5feb6387d5f39d1a9bac5a770cee4e3f6193867a4afec3deac14a74f68426f43d671aca36d3542400f92ceff00b45f271d220c5df70a2340d5bf7945772190787e713be4490a71a10bad37379ca5e90f4d2065d1ccaec4ad9129f8364c8b1d3304e9194bc47768bdd440265ddde26c42305a02faf52086703052d4d10b234e97624ac0198a63cc377c265f57425089cdfbfb27643530465664bb30aca60145cdf7b668016d27b25b5832703047c2199f60127d3f59ddffb95515bb5d5120b95f2bb8ee77a7ed1feb9083913b7ff0ad8d553eb6a5f01fb786f427ae678766b79837cd21e738dd0b60997c71d6e45676e62a74e8ba222cf3b6531bd0fcb84112810c1660b32a951d8bf9080ebcd554a45e71d909f721d2c5cf639641ec4c5b749afa16e8eac1f04fb33e316743074e8c6197e17d8dbf3dcb2fbd6f05d8c6d813f3a13831452ee29d9f942a2b2a9b28c9a88e426841599d6705984fa6ae098f5168dab0cb08e295493c00060470241618cfabaf0b2d37840e1688cb2325e6e46956fd241bb056599d871f45e986d4143792ef126ffa2427a6129b57007cf0dd703edabcfc2b3a715ea7142f61cbb21448586493466e9912801387a7eb12b7fc9f45572d184dc3ced0dd348b75733a9316c580262b3f38bd0b00442ffffc710a784613bd076bb53fac5504e287f1982f7c46d06e7a8b59849071faa2fa48cd90a1a00d6937f7829c8a19e53ed7f7df44aa6795f159d8cacadbdb072b7c5d801a8573f7774d7461df14caf76d3ace53484b86289b5c475261464b92a93b6b98d09897c9c0e297ab3380d72e8139dfc1878ccd67f924d8a7bbfa8e9803e6056b22962893f1c93e35f7b803b2f2c7b39c58cfb3fc612b1607a574f550a7556cb3935aef41585278637ac41da857cb24d9460c86780a8113ba7a9a7346998a60a7658cb6042af7b80595c8b1c0d28f9c22daedbe5f408dc8d9fe1fefd10c65ae57d0474d417ddf0be601d05554ae04c9f4243ed0a05a280d6e493f002f085c8197892a7910403fb5a304f58827a486414dfad874423a213d9cfc961010348f2ef2defc74fd3870e8b20ce0e9a36ad3420be62f01b38ba891d48256e02ea09b281798a4d61f846800c5e9b66b5f9966fc4d2ea7dab2ad1c3d94186508f1a5d5c1350be182534a8395255ec1e0c8038020c10eb6c30bb27a05c39eead3f3fe7ef221d40898e3c7ad4f6ec446f397a7c0bb590f8107019ce8eb10fbc71b99f3df130f11f2cac9e44ced065658b327b7eb5dbb3ff5f1d0bee511b52eaa828cad2f92fcec39adbfaa4fb0f558192e9d72c32589700d1bf96c6c50566c9b60016681982b7342c86e2b48705e233a1ff5d57d8ac570a0f3fd4dab168ff417592077d3ebad5d7a3cf4bc0a7f670cd15f46188f3195ce1c198c803b63dd491690df2721771fbd39b3303e655baffaa3ab40720041423b36600744a709fb322067908f7c8b3eaa2c872fcbd96c60a55f8b6ca414d6bb2e5e24fd4ac4a1bed0eafb9b5e95d706c674ba97ba19d27d406d69eb78976df1b151b1f1ced5dc19b6cfbb83c24c4db062afc42d42a9fda14eb8cf12caf65e37cc3b9e8a3ca0771a4aa04e1e130440d5de83787f4f1149ca24c5be89d3c2325c5a971b65252c9e4e4da2eb5d6323842d54d6bfb1b35690453606d804c68df11a88b9a1a6e382f76bf0e6b13283772f471f99a10dc2aba2470e704d53c81a1df0fb263f299a415015d3198ac74b41311d1f5fe14b50c50e905412bfb0ec9bac32b9e4f34676cfc5f9017f17f8d079379722852044833940f9a5fbd6636fc343520c7c99f3be073f59ceea74b8a62158128a8978dee74f8e0acb877415955871af7c7bcce158d947b6a0a68f94c826ab5fe6a86f653c0067a5b358119f22a0e2d2df3ab7f5b9f7b5ce14517e9e7aa6894bee264ee962b687e9fa9f732656045734df646250d6d47e7ff82fe770aef20ef6dba35b23f33d6561d1b6ffe7850f526e7db935269b8da562302db6645f95f73d3dddeb65e8bb52fd0f2d6aeedd83e593e317e1712cb81a2f2f09f9d783b8afc623219d685433f1bcb2e37d58f23fd03ec8279a3df5adbb9d0e29094132dc2a2fe3c5ef23758747a76e864042b2a8fc7012112f9f31617b3d3bd79e6de07f98996c66a39e9627c51d132f1d8abcf602a8a53e7e8db0d38fad9506fd3de407efb695d4eac43b2e666294eee04a3530e6c8b27e86c58afdde832225a8ece88105ce2ab97088ecd7405387ffeca823fabc7a7bff34efa0a0ddb1bb443839c19abfa00b926af55b15a6af72bf91f09fbce9c5824e2e93916bb2ba09613002a3e142026167932e29423423df849b8b8484ae3c5400a0a5e794fb364ccc515e7d5d1618e33751ef3f6e0ae5cf99182ffbcc86a98feecfb93ac5d508cdcbb12c3a2b334842a844241a2a5a68e7ff1bc3cde1ef7b01c1acd908cc4d3b5c0002915d3214afc141a6ea4e3f78e062ccb3dd03653885c6fe2a155014d5954959e3a46536d55047d1c3e3f6c1a7b14313db64fad29920520d0d86218d92b504c561a001eb3e2241464b4138531b9d1de259c55702f8eaddd4fe84058b433a7b1fb52c8b674d062793cad68b988e3395e2d6958895b3bfb21e00e658b2d141d39ff7bd215a91dfff9c43b829e09a83ac92a8a7fc04eccc1ca48528fd9a6f759ae6783811f7ce744efb2d15e220767e417e77c65a1491bf7d2e49eb0771f8d4c96e1864b230e394e5c365dda64f39af8f5e6c74fe602ff5539a2c0ae7f43c1f364d3892d6851874cfded83170c1afcfa840f10730926013aca5f91af998a95397ce70c9b6dbd7cb1f5ce59f166e2d1ef25ce888a0afa19268f7674177f4a2a80d19311272faa37563b26313d1a211e5c3b348c1274ac9b9682942f09b10f1d7bb3ceb5f1da998bc42f07561ba12494599821e53e0d22a0749dc8341eff4f029c726238ca28232dcafcdf8730c4c32b2c0bc6167d488d760185733fb3807d5ca0a344fb615202e1f2655bc960d1ed0e471f029b3b32402371d7e29f48cb88d3089a9cf8dafecbb82a10768c15764fc03637b30ae68f8bf81f3d5c0b713c1a398a3ea6a5f4760e2bb78edb635c347c580d4b5163b5e6faa5f931ab3057e8300f5f4c7972d0ebe003b87be9088208ea4aedfc83ed74fc04a9bc3fd71699d227bb830d84394e97394c17a3fd3235d2ebc88d7335af54e64182ccbbf02cc3412a47aea43bb65e5b6c785c9b9e7a6af82da714225482cdff9a33363326c9dd8a6abdfb074df82ec5a920b62ac4d5d1af678d8d7d700b8400c259a7eeec97e2d074ea6469c137b86f581ec48efc6d28167d552f67a0327f1da07f9dadae34987e1e27b0ba460c79daad91e31dc3a29bde0b919dee6984989af40812c34dcde24a0d3d4aad3912a9ff147447d69bf6247a756aa12e26f2790a8d699569f8c6d4d9a9e772318a7bc15b6ffe715bdac4c50a2f4387a7980f2f5fa1f95da79d40fe89489981fcb733896f04eaafbd7d2dce51806ad889c6e9432fb8b1ddf0de78e228f033e95570050ce1e359996f112548913a0bd37a79e9da87a3212efc42bda94560385f7ef970c2532f9fdf0309da81b6ec133d857b7bac514ab1b1ff6c4cf9beca211bf7ab81fb1f76e72113b64dc5f8775531fa27c10154d6d3fb05bc747f5c44910a647a1b69418d845f7638ee0ec5b2640032e24b42a2887eae3b0313ec62310e26b288c762194506aab3dedb4eb99c7a52f536587126763414774cdd63aaeb87456c945b6f3226b8271a29696f06ee56d57c82771fdc9f8902001aaae5737d11dd0366e12a9c28486664f1398ba804c5f3384807c45ec16183f49b9e553266cfe6dc9309513241a46eb970fe22db879fb88487f265c99276c2825cc5e9573489056582a1e80ed7d2c2448ce3ef21e9367b9c60569488e9f286e57a925152dab44a8a207e6fd8b36abffa6faee2259d6d73b0d2bf57bcf918d17a3361b2c1c64b5fb7084c678c65033d9b07ee55d3f9b81d9fd5208dffc93317083a501ffda40a52c63366583a90ee87e847e2475b14d2043003cef1bac45a305fa30c2f291d61084be93096af2ad50a4cb56e1c1a1955208b4546b6fc5c7b39d17dbc65a977877190ed652e2a573c6ee95d1e7ccb2868f4b568286c319bcea713b20c49e3f152b096b43ad667fb5417fe7d42b162c8ac897d45d60ecb1bc5e614a989a7a9cfc5803934c1e261e0b48f47a7376c50c3f4ae50513b94453a5477ac8753482018d23ce19731e18a3dda4d5e8871406eb1d5b73c680bac65786d4ccb1b61bd89196b68061831a1f4876b4e61aa3f9c7096626be2895fde11d201124d4b5e283acf1f6a2ae45c1e6ca798d64ea7f1b3333c9ec526904b6c104e33040c03ea074617e31d9da4e20261595292382d72e15a098784dcb00dfe0b5bcfdadaa5f137b78374410db0d622114aa35d4a2a24c30b4c5ae673c78591e160dcd47699af2ce63b254cdc1d30663dd38d9ef01f43a4ecfeb981a951feba050e42421b6ddc7ab15c32dd7ec0d169f9b5eb44eff1c0d1fc47f185a2d1f6dd6ee6999f1b1269a4e260ef6f0244b7ff53c1b679c4ffe843441412bab691b5e858a6053bcc150ad257d8095132bbc07dbb0d617e9105e66a2686ee4eb"}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x3, 0x0, 0x0, 0x2, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40585414) 4.411701492s ago: executing program 0 (id=2290): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000001b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001180)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xbf}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008800}, 0x20004010) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010}, &(0x7f0000000040)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000140)=0xfffffffc, 0x0, 0x4) 4.411242896s ago: executing program 4 (id=2291): socket$nl_crypto(0x10, 0x3, 0x15) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYRES64=r1, @ANYRES64], 0x20) 4.387544675s ago: executing program 2 (id=2292): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000c00)=ANY=[@ANYBLOB="b4000000020000006600000000000000730121000000000095000000000000004bb5eea0a6ec9fcd4b0a008a8443f22702000000e63bde9e4a0587536a966992ae7011d6e6c03175717e9912e0dd1a59541f7cbb1548ee5bd627f5b0b8ec77bd6d5f7b543f9aafaabe53339b12fbbe7decc4aa61b8aad0359083bdd61543fbeee8d560bb4b5925fae801f4c91e31674b124a1b38000000bc4da4a9b3d5cc9e0000f6a7a729009973ff07000000000000ac79e5d84abbec7d96629490727375b853f6308a980fba61fbe0131f3c7a026d8f000008000000000000000b20d7ac2df89d7989bf53bec908213d396edf24e9fc3cc004a1097fddc65c1b1b328277ff85ed56b9261eb7bcee28ec2d3616689ab3f31f849eebce6f21e6302003c0467844e000000000db0700bd694a09b253a1c6c7c138b3ec6ee9b83edcc55d3403acd5c50e2740a7ab7069790da79b7ab45184caffff00009bab066bf7a4ab148d44c7e2e4d219cdd7ebeb51511d9df85a648b1b85f93cb6cd21f93d5ea3da2b31657c065d052d9b9ee00320def97ebac25b929b3c15e33be6e7d54e622b427ee8d181d2f18d772fb5c58a936620ba1f5fbb48703ab211f442697edc165b449db2e3c221fbf270a6db414516949b97c200000096a1cbe81a38a23f03bd741a3e60c2e294f828e06f1b2cb70328f151f949e369efed52a28b87aae9d7d2800c8eff7f93c05adc9086d3f143a7b87d06838c6525cafdc01820a8912a131ff1f6acb9439f2d95a746291641b38333ce1c84b0d9d033edc9da00c8a2b42e8adfeff69fce7a35f79748e3e5b235269310988a05bf7c4e4cef3d1aa550c83d6328eb000000044a6458c31431d58973c93f5e9452258a7098bc3d014afe638a40948498fa9561213bc20845526e054d6b3ba5ca8f357df67c41acc28edacb31d38994544c3511ea1e8a448e66039425cfb03efb5d5eb81a306746adb8809ef969187763c00085e2dc401325327e54cbfceb400c2663466cd4a79c94b62c9882626499a8a29c564464f2a7aee6a929f831c93d23005787d272b5eaf0c6e11a7f0f1f39f68df44f6bf2d9b51d99c89e327b4bf7b96ad33abbd3a8b5814b5e7f85d1a47ee604ccef20bda53c9ce06910568fc200eee12fc6ef2734a6e9af5132f0c507e277fd97f9b48c840697289d38e454467f4d2f94b2f76d06edd083dafefd76deb251b5818de9c27d0df6e7b8862fe42f6c453f551f35b6d76395a1d205f276ae628fbdb8081905a1d7c2805532d3387b88f2997e8ce41c5dca83659cfb7f3a1c7b2bec8a7575dc4241dde6c680ee9a27b197739f4ad86f3bad3e42d4954bef864586ad02c27858d63efc495bcfb6ed49a5ca8987b0f2a8b14054e30f30fedf536d63769a196fc3b472195d0a1a13ecf803136d751cefb0edb5794cab8681214b39f86d88f3aebea4d465ef05f975b09f264d6c8d8e3bb6ea7d21c6602bcc8f76f2546cccc074f55c22aa8b502968040000000000000047c8a50036dd268a1aeff951f5090492b5e941feb1d3785aafe1655876e5a36c40fb5afcfd1eb28952662782097836a4d1aa3de0c06bb7dc27cf1a546b6aa6ce9932f3c6a013bc3791da4d8a33680ba8f1334d75a43e991ebd4582d786ec05cdd3152d52ab15fc7595cbd339f730d2ec8e37e6c500c4c30280a6af986f62a22d9c5c275e7798c165545abfcd304243274db15924a136a0896d56576ed7de90b1bda90f4024b9a0b3b33f688db8e38f784ae3942aba874f95d10c47e2405ceb0438cc272133fac718a6553710e4ca97df646b21d02652c54eade2e99344e11a2671cf274d397650fba8fcfb7e51a926e37b3980a1732111175dd99b9d979042b3ea411a7b4f9081ae9b82974d5eb6fd4e4bcd95e4f897dfba4e44777e6d02a896b650a66d9139696b926c36a33eb3bdc092bf4586bfab34002f802bbfe6a7679cec20cc25e01f129bbe92a65961fac7bffa3d8feda2ac927743d2bce57ee39b671948576337535180aa754e03"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x2, 0x4, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x2, 0x80000, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r5, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r5, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="ec000000210001000000000000000000fc0200000000000000000000000000006401010200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000009c001100ac1434aa0000000000000000000000007f000001000000000000000000000008fe880000000000000000000000000101138100000000000000000000000000aa3c04000002000000"], 0xec}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="01c685913100020000000110000004000180"], 0x18}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 4.285205544s ago: executing program 5 (id=2293): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad", 0x1) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000003c80)=ANY=[], 0x12f4}}, 0x0) recvmsg$unix(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000880)=""/27, 0x1b}], 0x1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0x541b, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r6, &(0x7f0000001f00)={0x2, 0x0, {&(0x7f00000004c0)=""/110, 0x6e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r6, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000780)=""/212, 0xd4, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r6, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000640)=""/201, 0xc9, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r6, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x80000) recvmsg$can_raw(r8, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40010022) 4.227749413s ago: executing program 4 (id=2294): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad", 0x1) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000003c80)=ANY=[], 0x12f4}}, 0x0) recvmsg$unix(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000880)=""/27, 0x1b}], 0x1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0x541b, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r6, &(0x7f0000001f00)={0x2, 0x0, {&(0x7f00000004c0)=""/110, 0x6e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r6, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000780)=""/212, 0xd4, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r6, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000640)=""/201, 0xc9, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r6, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x80000) recvmsg$can_raw(r8, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40010022) 3.489684263s ago: executing program 2 (id=2295): fsopen(&(0x7f0000000040)='affs\x00', 0x1) r0 = fsmount(0xffffffffffffffff, 0x0, 0xff) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x0, 0x0, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r3, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r3, 0x0, 0x0) process_mrelease(r0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000000)="7541c3da99") 3.141196561s ago: executing program 3 (id=2296): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="020200020b0000000000000000000000010b080000000000020001000014000000000588000000a0030006000000000002000000ac1414ff00000000000020000300050000000000020000000000000000000000f9a094eb41c8f1bf7dba0308e34e775197832fa7ff8bd666b2295a346f37f8cbc3043a947bf20df98bbc11a21b0f0105b0b7d917941965cb00"/152], 0x58}, 0x1, 0x7}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x8000, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100), 0xd79, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000002500)={{0x2, 0x4e21, @multicast2}, {0x6, @multicast}, 0x1c, {0x2, 0x4e21, @remote}, 'veth0\x00'}) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000000000)=0x40000001, 0x40000001) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r5, &(0x7f0000002280)=[{&(0x7f0000002180)=""/18, 0x12}, {&(0x7f0000002840)=""/231, 0xe7}], 0x2, 0x10001, 0x7) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) write$nci(r5, &(0x7f0000000080)=@NCI_OP_RF_DEACTIVATE_RSP={0x1, 0x0, 0x2, 0x6, 0x6}, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x1df) socket$inet_tcp(0x2, 0x1, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0) 3.112211618s ago: executing program 3 (id=2297): r0 = socket$alg(0x26, 0x5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000080)={r7, 0x3}, 0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x18, @mcast2, @mcast2={0xff, 0x3}, 0x0, 0x0, 0xfffffffe, 0xffffffff}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r8, 0xc0045006, &(0x7f0000000180)=0x6f) r9 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) read$dsp(r9, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r8, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x4, 0x0, 0x6}, 0x1d, [0x8000, 0x78, 0xf, 0x9, 0x80, 0x2, 0x203, 0x7e, 0x6, 0x4b, 0x39cc1919, 0x40, 0x9, 0x5, 0xffff2d37, 0xffffffff, 0x6, 0x7, 0x0, 0x5, 0x3, 0x3, 0x5, 0x3c5b, 0x1, 0x1000, 0x9, 0x3, 0x15bb, 0x2, 0xe65f, 0x3, 0x7, 0x6, 0x7fff, 0x7, 0x80000000, 0xa72, 0x3, 0x9, 0x0, 0x71, 0x407, 0x5, 0x1, 0x5, 0x9, 0x3a, 0x7, 0x6, 0x6, 0xfffbffff, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x4, 0x9, 0x8, 0x7, 0x21, 0x40], [0x10000007, 0x3, 0x800, 0x8000, 0x10, 0xffeffff3, 0x8, 0x200c7, 0xf9, 0x10, 0x2bf, 0x6c9, 0xfff, 0xfffffffc, 0x5, 0x0, 0xd14, 0x5, 0x2f, 0xe, 0x4312, 0x78, 0xea4, 0x0, 0x4, 0x24, 0x8000, 0x9, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x5, 0x0, 0x7f9, 0x0, 0x2, 0x2, 0x9, 0x5, 0x9, 0x0, 0x800000d, 0x5, 0x2007, 0xd, 0x1, 0xfe000000, 0xffff, 0x2, 0x7b, 0x9, 0x3, 0x3, 0x9, 0x1, 0x7, 0x0, 0x9, 0x48c93690, 0x42, 0xffff], [0x7, 0xf5fd, 0x0, 0x5, 0x1, 0x100, 0x8d2, 0x9, 0x800003, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x5, 0x20000005, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x0, 0x3e7, 0xa, 0x5, 0x2, 0x5, 0x3, 0x8, 0x8, 0x6cfc, 0x5, 0x39, 0x800003, 0x200, 0x80, 0x3, 0x4e0a, 0x7, 0x1000, 0xa2, 0x7, 0x9, 0x5, 0x6, 0xac8, 0xffffffff, 0x2, 0x11, 0x7ff, 0xfffffff9, 0x0, 0x10000, 0xffff, 0x2b98, 0x6, 0x4, 0x120000, 0xbe, 0x0, 0xa2ed, 0x2, 0x25], [0x9, 0xbb31, 0x7, 0xb, 0x5, 0x7, 0xa, 0x80000006, 0x0, 0x5, 0x7d, 0xc9, 0x6, 0x6, 0x8, 0x57b, 0x7, 0x10000, 0x6, 0x7ffd, 0xfffd, 0x4, 0x20000, 0x5, 0xe8a0556, 0x2, 0x14c, 0x60a6, 0x6, 0x6, 0x3, 0x80000000, 0x5, 0x8, 0xce, 0xee1, 0xfffff000, 0x179, 0x3, 0x7e, 0x100, 0x9600, 0x56e, 0x2, 0x1007, 0x40000006, 0x1, 0x0, 0x8, 0x8, 0x30b1d693, 0xa1f, 0xc, 0x800007, 0xfffffffe, 0x3, 0x0, 0x4, 0x7, 0x2bf, 0x0, 0x200, 0xffff3441, 0x2]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x7, 0x4, 0x3d8, 0x10c, 0x10c, 0x10c, 0x2f8, 0x2f8, 0x2f8, 0x4, &(0x7f00000000c0), {[{{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x8, 0xffffffff}}}, {{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @empty, @private=0xa010100, @multicast1, 0x4, 0xffffffff}}}, {{@arp={@broadcast, @local, 0xffffffff, 0xff000000, 0xe, 0xa, {@empty, {[0xff, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0xff, 0xff]}}, 0x2, 0xe, 0x2, 0x2, 0x8001, 0x7, 'pim6reg0\x00', 'bond_slave_1\x00', {0x1fe}, {0xff}, 0x0, 0x100}, 0xbc, 0xe0}, @unspec=@AUDIT={0x24}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x424) lseek(r0, 0xf6e6, 0x1) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$VT_OPENQRY(r10, 0x5600, &(0x7f0000000100)) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) 2.631986218s ago: executing program 0 (id=2298): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket(0x2b, 0x1, 0x1) syz_usb_connect(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100002c23b740c71b4010b1b501020301090224000100000000090400000212c71c000905a42e7fbb00000009058202"], 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000440)=ANY=[@ANYRES32=r0], 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xb, &(0x7f0000000140)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfe}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x14) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) bind$netlink(r1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, 0x0, 0x0) 1.921089513s ago: executing program 2 (id=2299): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x81, 0x1}, 0x10) bind$tipc(r2, &(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x42, 0xfffffffc}, 0x4}}, 0x10) syz_usb_control_io$uac1(r1, 0x0, 0x0) setsockopt(r0, 0xde3, 0x90, &(0x7f0000000080)="d61d75c82ba62551bffb5bad0e470299932fc359f161e39207bb437f8d10c6740c8bde75f3a06b9b4dbe03be2ec64d2d23545c4152bfa11cdfd19ec21e0c1445d40adddab1e6c4eaca99fc054c35fcac5dc0391c7604a93b3e8893b329b14b4a78940deeb038bc36991168a550c276717ec930d1facf2a06cb0eedf2dc311c7f5ada797065e986f5ae1aaadd9246be94562909", 0x93) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)={0x0, 0x30, 0xc, "00004700000040f400bec073"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000140)={0x716, 0x10000, 0xf5cf, 0x6}) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="00b6aa"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_emit_ethernet(0x3a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff08004600002c000000000006907864010101ac1414aa07"], 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042402024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) write$vga_arbiter(r5, &(0x7f0000000340)=@other={'lock', ' ', 'io'}, 0x8) write$vga_arbiter(r5, &(0x7f0000000080)=@other={'unlock', ' ', 'io+mem'}, 0xe) write(r5, &(0x7f0000000180)="b79f4c68e41cedd0d9583229be0f431931be1ad5e2c08c183f2b76", 0x1b) r6 = dup(r4) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r6, 0xae78, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300"], 0xc0}}, 0x0) 916.973439ms ago: executing program 5 (id=2300): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_emit_ethernet(0x36, 0x0, 0x0) rseq(&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) openat$dir(0xffffffffffffff9c, 0x0, 0x100ea, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000340)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f0000000200)={r2, 0xfffffffffffffc01}) close(0x3) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000e50fc040da0b5080c48300000001090212000100000000090474000009ea0d004fa798be4bba78e671758c44d8a17941ea5270951059a0410d479ce3e9cd8e7689ff9b80bd9bbdc147c4638aef53c6b719a7727d1c"], 0x0) listxattr(0x0, 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r3, 0xc0045516, &(0x7f00000000c0)=0x200081) socketpair$unix(0x1, 0x2, 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0xc}, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0xffffffff, 0x0, 0x0, 0xfffffffc, 'syz0\x00'}, 0x1, 0x2, 0x8, 0x0, 0x0, 0xff, 'syz0\x00', 0x0}) capset(&(0x7f0000000080)={0x20071026}, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000480)=0x1) r4 = socket$alg(0x26, 0x5, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000500)={0xa, 0x2, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet6_int(r5, 0x29, 0x38, &(0x7f0000000300)=0x80, 0x4) sendto$inet6(r5, &(0x7f00000000c0)="04", 0x1, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) r6 = dup(r5) write$UHID_INPUT(r6, &(0x7f0000001840)={0xfc, {"a2e3ad21ed0d1bf91b29420987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f31096c060890e0878f0e1ac6e7049b096e959b509a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b074b0d36cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130f91850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d86526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e613e20d80421d653a500008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec6bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f4077fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f8302d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153fae46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a922705391dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c343f7f140f319539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474b0679dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691951264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf040000006ebecd8d984836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238226407a4eddd5d0fc5a752f9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e00", 0x1000}}, 0xff39) bind$alg(r6, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) 824.730726ms ago: executing program 0 (id=2301): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000000200), 0x4) listen(r0, 0x80fe) 809.13805ms ago: executing program 4 (id=2302): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000a00)='wsync', &(0x7f0000000b40)="b2", 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000001380), 0x2, 0x501) write(0xffffffffffffffff, &(0x7f0000000040)="1c00000021002551071c0165ff00", 0xe) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000f40)={{0x14}, [@NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}]}], {0x14}}, 0x68}}, 0x0) socket$inet6(0xa, 0x6, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)={0xfffffffffffffffd, 0x1}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfeb4}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000bc0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d288168eda8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f117bdfe457f75e6f8200600f1a0e0f7643ba55fb18556858d4a4245b1e6caeeb0e52d05c3cb05983f295f1aae214d997a89a73e05534fddfde6271facada8f73b800845f8771c1e137412d98a2ad0844fbb3333c33a2884d6612424f96c337de938711ef7b9e98647a6b1aab208f998f96d9b3193ec72a89231e1acf6c4313bc6e45eff28305127bb773c2da0dcecf671a29647fac07844794", 0x169}, {&(0x7f00000002c0)="ce7ccd2d2c944169dc2b5dc4d1ffa850037245431cc5946071313f750701a08961f7fd07f408eb9136351299f22ffc3dfcc5343fa0f2", 0x36}, {&(0x7f0000000880)="8409220927e07db54a2722fa855b95004eb46eaeea27299765f609fd9a87344a8aaeb4b0aaba401545a2ec1fcc4239a328173fdb7698d2b055debc3ddbf4399afcd6838e8cdb5932b5f09863bf1f794b2ddce1b43cf8f1f7a251e276374f4846610ef2659c918492a7beddeb614e8f3d1680aac2a6dd735b00f3185535a2023e92a8514bd3f6b3e143ebc13026046616fa087bc64d0ce6210f09209c554b7edc302c4006db6fcd8fe1b310bd4f7b8ef216a5aea03173517f67a402c81fde4fa30076dc00f50faea04a8960a2e63fbd0841f0f5748907b5b959e3e9e0923e1030"}, {&(0x7f0000000300)="1179189127c144acffec4d"}, {&(0x7f0000000340)="b957851c8f100096878ec4adc3a1"}], 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="0000fb89962661651b7bcc94da7bd7e8cb00001701000003000000010000000000000017010000040000000500000000000000170100000200000000000000f4557afeb0e1196f866757ac4f155f716d514ac4e5d301a9052d59c559dd36c195ab00000000000017010000040000001ff700000000000017010000030000000100000000"]}], 0x1, 0x24040881) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) 657.276518ms ago: executing program 0 (id=2303): syz_open_procfs$namespace(0x0, &(0x7f0000007880)='ns/cgroup\x00') socket$nl_crypto(0x10, 0x3, 0x15) socket$inet6_tcp(0xa, 0x1, 0x0) pipe2$9p(&(0x7f0000000200), 0x4000) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x20) 555.842038ms ago: executing program 0 (id=2304): r0 = openat$vicodec1(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000280), 0x774a, 0x2) ioctl$vim2m_VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000040)={0x2, @vbi={0x0, 0x2, 0x3, 0x384c4150, [0x4, 0x1], [0x1ff, 0x9], 0xfeedcafe}}) mknod$loop(0x0, 0xfff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'syztnl0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000040)={'syztnl1\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x20, 0x700, 0x9, 0x889c, {{0x5, 0x4, 0x1, 0x1f, 0x14, 0x68, 0x0, 0xfa, 0x29, 0x0, @private=0xa010101, @broadcast}}}}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000180)={0x8, 0xffffffffffffffff, 0x1}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000003c0)='dns_resolver\x00', 0x0, &(0x7f0000000080)='\x00\x00', 0x2, r5) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) futex(&(0x7f0000000140)=0xfffffffc, 0x5, 0x0, 0x0, &(0x7f00000001c0), 0xfffdffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000800)) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000000)={0x3, @raw_data="d35ad4b35328682fb277c39d6fa06a5047eba7273cb514e2f5eb3ab24acaaac0cea38684f106de8d6ad90bb45a0c5b55e6b3b515a262e02af681ae4131cbfa495dcb660f1121e0deb55744de22f4442eec53edd2008efd6647e0ccd48418a0d95ec0b4fa95e8acccbdadda88dcdb0d9b0087346eda5b1728781d4bc39eca6970c8deeb2816fd7f488fdf4647aeb94f3fdf8379938220897fdd9c09f99049ac08d256210ba56cf0e160f72e78939e88b349400dd9a955d4ca556536fbe5e2e7297ab7f34883de6a30"}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='pids.current\x00', 0x0, 0x0) 0s ago: executing program 3 (id=2305): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40010) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x340c4191) kernel console output (not intermixed with test programs): transport stream to the software demuxer [ 551.380135][ T5837] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 551.386844][ T5837] usb 5-1: media controller created [ 551.423150][ T5837] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 551.567269][T17447] netlink: 'syz.5.1833': attribute type 1 has an invalid length. [ 551.594481][T17447] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1833'. [ 551.599531][T17451] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1828'. [ 551.815060][T17462] FAULT_INJECTION: forcing a failure. [ 551.815060][T17462] name failslab, interval 1, probability 0, space 0, times 0 [ 551.946073][T17462] CPU: 0 UID: 0 PID: 17462 Comm: syz.0.1835 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 551.946106][T17462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 551.946120][T17462] Call Trace: [ 551.946130][T17462] [ 551.946139][T17462] dump_stack_lvl+0x241/0x360 [ 551.946177][T17462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 551.946206][T17462] ? __pfx__printk+0x10/0x10 [ 551.946236][T17462] ? __pfx___might_resched+0x10/0x10 [ 551.946265][T17462] should_fail_ex+0x424/0x570 [ 551.946299][T17462] should_failslab+0xac/0x100 [ 551.946323][T17462] __kmalloc_noprof+0xdf/0x4d0 [ 551.946345][T17462] ? tomoyo_encode+0x26f/0x540 [ 551.946376][T17462] tomoyo_encode+0x26f/0x540 [ 551.946421][T17462] tomoyo_realpath_from_path+0x59e/0x5e0 [ 551.946459][T17462] tomoyo_path_number_perm+0x245/0x790 [ 551.946483][T17462] ? __lock_acquire+0xad5/0xd80 [ 551.946504][T17462] ? tomoyo_path_number_perm+0x215/0x790 [ 551.946530][T17462] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 551.946580][T17462] ? __fget_files+0x2a/0x420 [ 551.946603][T17462] ? __fget_files+0x2a/0x420 [ 551.946628][T17462] ? __fget_files+0x2a/0x420 [ 551.946655][T17462] security_file_ioctl_compat+0xc6/0x2a0 [ 551.946682][T17462] __se_compat_sys_ioctl+0xd8/0xc30 [ 551.946714][T17462] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 551.946735][T17462] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 551.946766][T17462] ? __fget_files+0x2a/0x420 [ 551.946792][T17462] ? fput+0x9b/0xd0 [ 551.946816][T17462] ? ksys_write+0x275/0x2d0 [ 551.946850][T17462] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 551.946883][T17462] ? lockdep_hardirqs_on+0x9d/0x150 [ 551.946914][T17462] __do_fast_syscall_32+0xb4/0x110 [ 551.946934][T17462] ? exc_page_fault+0x599/0x8b0 [ 551.946967][T17462] do_fast_syscall_32+0x34/0x80 [ 551.946987][T17462] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 551.947013][T17462] RIP: 0023:0xf7fe4579 [ 551.947030][T17462] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 551.947048][T17462] RSP: 002b:00000000f510655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 551.947071][T17462] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0cc5605 [ 551.947085][T17462] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 551.947098][T17462] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 551.947112][T17462] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 551.947125][T17462] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 551.947148][T17462] [ 551.947168][T17462] ERROR: Out of memory at tomoyo_realpath_from_path. [ 552.357789][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 553.391125][ T5890] hid-generic 0000:0003:0000.0055: item fetching failed at offset 0/2 [ 553.408805][ T5890] hid-generic 0000:0003:0000.0055: probe with driver hid-generic failed with error -22 [ 553.463709][T17499] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1843'. [ 553.477018][T17499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.486276][T17499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 553.827931][ T5890] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 553.852756][ T5837] set interface failed [ 553.852797][ T5837] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 553.904307][ T5837] error writing reg: 0xff, val: 0x00 [ 553.952262][T17513] FAULT_INJECTION: forcing a failure. [ 553.952262][T17513] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 553.999599][T17513] CPU: 1 UID: 0 PID: 17513 Comm: syz.4.1845 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 553.999633][T17513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 553.999646][T17513] Call Trace: [ 553.999654][T17513] [ 553.999663][T17513] dump_stack_lvl+0x241/0x360 [ 553.999700][T17513] ? __pfx_dump_stack_lvl+0x10/0x10 [ 553.999734][T17513] ? __pfx__printk+0x10/0x10 [ 553.999769][T17513] should_fail_ex+0x424/0x570 [ 553.999806][T17513] _copy_to_user+0x31/0xb0 [ 553.999836][T17513] simple_read_from_buffer+0xc4/0x170 [ 553.999861][T17513] proc_fail_nth_read+0x1ef/0x260 [ 553.999890][T17513] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 553.999919][T17513] ? rw_verify_area+0x246/0x630 [ 553.999946][T17513] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 553.999974][T17513] vfs_read+0x21f/0xb90 [ 554.000005][T17513] ? __pfx___mutex_lock+0x10/0x10 [ 554.000027][T17513] ? __pfx_vfs_read+0x10/0x10 [ 554.000058][T17513] ? __fget_files+0x2a/0x420 [ 554.000083][T17513] ? __fget_files+0x39d/0x420 [ 554.000106][T17513] ? __fget_files+0x2a/0x420 [ 554.000136][T17513] ksys_read+0x19d/0x2d0 [ 554.000165][T17513] ? __pfx_ksys_read+0x10/0x10 [ 554.000196][T17513] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 554.000229][T17513] ? lockdep_hardirqs_on+0x9d/0x150 [ 554.000269][T17513] __do_fast_syscall_32+0xb4/0x110 [ 554.000290][T17513] ? exc_page_fault+0x599/0x8b0 [ 554.000323][T17513] do_fast_syscall_32+0x34/0x80 [ 554.000344][T17513] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 554.000369][T17513] RIP: 0023:0xf740d579 [ 554.000387][T17513] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 554.000406][T17513] RSP: 002b:00000000f5096590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 554.000429][T17513] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5096620 [ 554.000444][T17513] RDX: 000000000000000f RSI: 00000000f73fcff4 RDI: 0000000000000000 [ 554.000457][T17513] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 554.000470][T17513] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 554.000483][T17513] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 554.000509][T17513] [ 554.001199][ T5890] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 554.243252][ T5837] dvb_usb_mxl111sf 5-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 554.263403][ T5837] usb 5-1: USB disconnect, device number 25 [ 554.293980][ T5890] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 554.303392][ T5890] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 554.312750][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.454504][ T5890] usb 3-1: config 0 descriptor?? [ 554.470672][T17522] netlink: 'syz.0.1846': attribute type 1 has an invalid length. [ 554.480761][ T5890] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 554.496460][ T5890] dvb-usb: bulk message failed: -22 (3/0) [ 554.515546][T17522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1846'. [ 554.531275][ T5890] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 554.541184][ T5890] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 554.844638][ T5890] usb 3-1: media controller created [ 554.943357][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 554.991183][ T5890] dvb-usb: bulk message failed: -22 (6/0) [ 554.999738][ T5890] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 555.041841][ T5890] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input97 [ 555.082521][ T5890] dvb-usb: schedule remote query interval to 150 msecs. [ 555.097053][ T5890] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 555.248640][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 555.254694][ T5890] dvb-usb: error while querying for an remote control event. [ 555.427842][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 555.433984][ T5890] dvb-usb: error while querying for an remote control event. [ 555.607833][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 555.613829][ T5890] dvb-usb: error while querying for an remote control event. [ 555.827960][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 555.833784][ T5890] dvb-usb: error while querying for an remote control event. [ 555.997804][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 556.007099][ T5890] dvb-usb: error while querying for an remote control event. [ 556.039057][T17561] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 556.207812][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 556.220143][ T5890] dvb-usb: error while querying for an remote control event. [ 556.228232][ T120] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 556.318256][ T5890] usb 3-1: USB disconnect, device number 23 [ 556.380383][ T5890] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 556.399132][ T120] usb 1-1: Using ep0 maxpacket: 8 [ 556.418058][ T120] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 556.446421][ T120] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 556.460677][ T120] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 556.472085][ T120] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 556.487182][ T120] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 556.496902][ T120] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.720066][ T120] usb 1-1: GET_CAPABILITIES returned 0 [ 556.725883][ T120] usbtmc 1-1:16.0: can't read capabilities [ 557.062156][ T120] usb 1-1: USB disconnect, device number 17 [ 557.232296][T17612] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1857'. [ 558.717905][ T7393] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 558.763197][T17639] futex_wake_op: syz.2.1858 tries to shift op by -33; fix this program [ 558.848333][ T7393] usb 5-1: device descriptor read/64, error -71 [ 559.035660][T17641] FAULT_INJECTION: forcing a failure. [ 559.035660][T17641] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.068089][T17641] CPU: 0 UID: 0 PID: 17641 Comm: syz.0.1863 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 559.068130][T17641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 559.068144][T17641] Call Trace: [ 559.068153][T17641] [ 559.068164][T17641] dump_stack_lvl+0x241/0x360 [ 559.068202][T17641] ? __pfx_dump_stack_lvl+0x10/0x10 [ 559.068227][T17641] ? __pfx__printk+0x10/0x10 [ 559.068258][T17641] should_fail_ex+0x424/0x570 [ 559.068294][T17641] _copy_to_user+0x31/0xb0 [ 559.068325][T17641] simple_read_from_buffer+0xc4/0x170 [ 559.068352][T17641] proc_fail_nth_read+0x1ef/0x260 [ 559.068383][T17641] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 559.068413][T17641] ? rw_verify_area+0x246/0x630 [ 559.068442][T17641] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 559.068470][T17641] vfs_read+0x21f/0xb90 [ 559.068503][T17641] ? __pfx___mutex_lock+0x10/0x10 [ 559.068525][T17641] ? __pfx_vfs_read+0x10/0x10 [ 559.068556][T17641] ? __fget_files+0x2a/0x420 [ 559.068583][T17641] ? __fget_files+0x39d/0x420 [ 559.068607][T17641] ? __fget_files+0x2a/0x420 [ 559.068639][T17641] ksys_read+0x19d/0x2d0 [ 559.068669][T17641] ? __pfx_ksys_read+0x10/0x10 [ 559.068701][T17641] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 559.068735][T17641] ? lockdep_hardirqs_on+0x9d/0x150 [ 559.068768][T17641] __do_fast_syscall_32+0xb4/0x110 [ 559.068789][T17641] ? exc_page_fault+0x599/0x8b0 [ 559.068821][T17641] do_fast_syscall_32+0x34/0x80 [ 559.068841][T17641] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 559.068866][T17641] RIP: 0023:0xf7fe4579 [ 559.068885][T17641] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 559.068905][T17641] RSP: 002b:00000000f5106590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 559.068929][T17641] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5106620 [ 559.068944][T17641] RDX: 000000000000000f RSI: 00000000f746cff4 RDI: 0000000000000000 [ 559.068957][T17641] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 559.068970][T17641] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 559.068983][T17641] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 559.069009][T17641] [ 559.304206][ T7393] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 559.438159][ T7393] usb 5-1: device descriptor read/64, error -71 [ 559.548111][ T7393] usb usb5-port1: attempt power cycle [ 559.889993][ T7393] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 560.137454][ T7393] usb 5-1: device descriptor read/8, error -71 [ 560.438212][ T7393] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 560.451536][T17674] fuse: Bad value for 'user_id' [ 560.459613][ T7393] usb 5-1: device descriptor read/8, error -71 [ 560.478263][T17674] fuse: Bad value for 'user_id' [ 560.692749][ T7393] usb usb5-port1: unable to enumerate USB device [ 560.857769][ T7373] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 561.057767][ T7373] usb 3-1: Using ep0 maxpacket: 16 [ 561.125144][ T7373] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 561.140094][T17692] netlink: 'syz.3.1873': attribute type 1 has an invalid length. [ 561.148187][ T7373] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 561.153291][T17692] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1873'. [ 561.180181][ T7373] usb 3-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 561.198276][ T7373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.371180][ T7373] usb 3-1: config 0 descriptor?? [ 561.743234][ T7394] usb 3-1: USB disconnect, device number 24 [ 562.246434][T17723] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 562.538064][ T7394] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 562.633599][T17734] "syz.2.1879" (17734) uses obsolete ecb(arc4) skcipher [ 562.678608][ T7394] usb 1-1: device descriptor read/64, error -71 [ 562.959075][ T7394] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 563.038180][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.044552][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.118165][ T7394] usb 1-1: device descriptor read/64, error -71 [ 563.228159][ T7394] usb usb1-port1: attempt power cycle [ 563.317996][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 563.487611][T17753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 563.502657][T17753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 563.579230][T17759] futex_wake_op: syz.4.1881 tries to shift op by -33; fix this program [ 563.592765][ T7394] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 563.621760][ T7394] usb 1-1: device descriptor read/8, error -71 [ 563.867812][ T7394] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 563.888730][ T7394] usb 1-1: device descriptor read/8, error -71 [ 563.998874][ T7394] usb usb1-port1: unable to enumerate USB device [ 564.367857][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 565.144446][T17790] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 565.168085][T17790] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 565.390860][T17802] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1894'. [ 565.458472][T17802] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not our slave [ 565.530998][T17802] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1) [ 566.139850][T17739] ALSA: mixer_oss: invalid OSS volume '' [ 566.226412][T17815] x_tables: duplicate underflow at hook 2 [ 566.541874][ T7373] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 566.606821][T17836] futex_wake_op: syz.3.1896 tries to shift op by -33; fix this program [ 566.742036][ T7373] usb 1-1: Using ep0 maxpacket: 32 [ 567.359544][ T7373] usb 1-1: config 0 interface 0 has no altsetting 0 [ 567.373731][ T7373] usb 1-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 567.383292][ T7373] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.393402][ T7373] usb 1-1: config 0 descriptor?? [ 567.438438][ T7373] usb 1-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 567.449579][ T7373] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 567.470437][ T7373] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 567.477914][ T7373] usb 1-1: media controller created [ 567.492327][ T7373] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 567.534813][T17845] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 2, id = 0 [ 567.535666][T17839] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1901'. [ 567.689408][T17855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1898'. [ 567.698488][T17855] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1898'. [ 569.218009][ T7373] set interface failed [ 569.218051][ T7373] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 569.249772][ T7373] error writing reg: 0xff, val: 0x00 [ 569.300675][ T7373] dvb_usb_mxl111sf 1-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 569.343123][ T7373] usb 1-1: USB disconnect, device number 22 [ 569.445886][T17903] netlink: 'syz.2.1911': attribute type 1 has an invalid length. [ 569.459345][T17893] netlink: 1072 bytes leftover after parsing attributes in process `syz.3.1908'. [ 569.466539][T17903] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1911'. [ 569.477623][T17893] openvswitch: netlink: Flow key attr not present in new flow. [ 569.942283][ T7373] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 570.267915][ T7373] usb 1-1: Using ep0 maxpacket: 32 [ 570.280640][ T7373] usb 1-1: config 0 interface 0 has no altsetting 0 [ 570.297842][ T7373] usb 1-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 570.308384][ T7373] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.327446][ T7373] usb 1-1: config 0 descriptor?? [ 570.343355][ T7373] usb 1-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 570.358132][ T7373] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 570.373050][ T7373] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 570.381178][ T7373] usb 1-1: media controller created [ 570.401965][ T7373] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 570.487908][ T5837] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 570.612181][T17930] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1910'. [ 570.637911][ T5837] usb 3-1: Using ep0 maxpacket: 8 [ 570.646525][ T5837] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 570.674275][ T5837] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 570.708631][ T5837] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 570.736289][ T5837] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 570.776249][ T5837] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 570.802869][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.037738][ T5837] usb 3-1: GET_CAPABILITIES returned 0 [ 571.043835][ T5837] usbtmc 3-1:16.0: can't read capabilities [ 571.449596][ T7394] usb 3-1: USB disconnect, device number 25 [ 572.275467][T17972] futex_wake_op: syz.4.1917 tries to shift op by -33; fix this program [ 572.443606][ T7373] set interface failed [ 572.443877][ T7373] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 572.476789][ T7373] error writing reg: 0xff, val: 0x00 [ 572.478413][T17979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 572.526842][T17979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 572.540929][ T7373] dvb_usb_mxl111sf 1-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 572.564030][ T7373] usb 1-1: USB disconnect, device number 23 [ 572.670583][T17997] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1920'. [ 572.681912][T17997] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1920'. [ 572.765633][T17999] netlink: 'syz.0.1922': attribute type 1 has an invalid length. [ 572.784566][T17999] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1922'. [ 574.526308][ T7373] hid-generic 0000:0003:0000.0056: item fetching failed at offset 0/2 [ 574.541445][ T7373] hid-generic 0000:0003:0000.0056: probe with driver hid-generic failed with error -22 [ 574.648934][T18038] netlink: 'syz.5.1928': attribute type 12 has an invalid length. [ 574.727942][T18038] netlink: 'syz.5.1928': attribute type 29 has an invalid length. [ 574.751706][T18038] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1928'. [ 574.787192][T18038] netlink: 59 bytes leftover after parsing attributes in process `syz.5.1928'. [ 575.197860][ T7373] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 575.608944][ T7373] usb 5-1: config index 0 descriptor too short (expected 64028, got 77) [ 575.638746][ T7373] usb 5-1: config 0 has too many interfaces: 241, using maximum allowed: 32 [ 575.647625][ T7373] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 575.710110][ T7373] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 241 [ 575.764728][ T7373] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 575.774265][ T7373] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.782428][ T7373] usb 5-1: Product: syz [ 575.789759][ T7373] usb 5-1: Manufacturer: syz [ 575.794380][ T7373] usb 5-1: SerialNumber: syz [ 575.808628][ T7373] usb 5-1: config 0 descriptor?? [ 576.181529][T18070] netlink: 'syz.0.1934': attribute type 1 has an invalid length. [ 576.200611][T18070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1934'. [ 576.559042][T18078] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 576.893196][T18080] futex_wake_op: syz.2.1933 tries to shift op by -33; fix this program [ 577.644637][T18091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.653870][T18091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.820474][ T120] usb 5-1: USB disconnect, device number 30 [ 577.831816][T18097] netlink: 'syz.5.1939': attribute type 29 has an invalid length. [ 577.864581][T18098] netlink: 'syz.5.1939': attribute type 29 has an invalid length. [ 577.939061][T18105] netlink: 'syz.5.1939': attribute type 29 has an invalid length. [ 578.287801][ T120] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 578.287801][ T7373] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 578.488121][ T7373] usb 3-1: Using ep0 maxpacket: 32 [ 578.489594][ T120] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 578.508901][ T120] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 578.520677][ T7373] usb 3-1: no configurations [ 578.520839][ T120] usb 5-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 578.527797][ T7373] usb 3-1: can't read configurations, error -22 [ 578.610014][ T120] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.649521][ T120] usb 5-1: config 0 descriptor?? [ 578.661340][T18113] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 578.748223][ T7373] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 578.917879][ T7373] usb 3-1: Using ep0 maxpacket: 32 [ 578.918371][ T7394] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 579.007418][ T7373] usb 3-1: no configurations [ 579.017945][ T7373] usb 3-1: can't read configurations, error -22 [ 579.054182][ T7373] usb usb3-port1: attempt power cycle [ 579.102102][ T7394] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 579.118464][ T7394] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 579.129244][ T7394] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 579.142288][ T120] glorious 0003:22D4:1503.0057: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.4-1/input0 [ 579.155131][ T7394] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.206360][T18121] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 579.221144][ T7394] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 579.487574][ T7373] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 579.607951][ T7373] usb 3-1: Using ep0 maxpacket: 32 [ 579.614012][ T7373] usb 3-1: no configurations [ 579.623138][ T7373] usb 3-1: can't read configurations, error -22 [ 579.828529][ T7373] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 579.998855][ T7373] usb 3-1: Using ep0 maxpacket: 32 [ 580.005487][ T7373] usb 3-1: no configurations [ 580.049835][ T7373] usb 3-1: can't read configurations, error -22 [ 580.075074][ T7373] usb usb3-port1: unable to enumerate USB device [ 580.687502][T18160] netlink: 'syz.3.1945': attribute type 1 has an invalid length. [ 581.024961][ T7373] usb 5-1: USB disconnect, device number 31 [ 581.212789][T18186] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 581.421762][ T7373] hid-generic 0000:0003:0000.0058: item fetching failed at offset 0/2 [ 581.442444][ T7373] hid-generic 0000:0003:0000.0058: probe with driver hid-generic failed with error -22 [ 581.747877][ T7373] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 581.841539][ T120] usb 1-1: USB disconnect, device number 24 [ 581.922457][ T7373] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 581.943678][ T7373] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 581.957920][ T7373] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 581.969809][ T7373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.998688][ T7373] usb 3-1: config 0 descriptor?? [ 582.030848][ T7373] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 582.039611][ T7373] dvb-usb: bulk message failed: -22 (3/0) [ 582.051351][ T7373] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 582.074425][ T7373] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 582.082224][ T7373] usb 3-1: media controller created [ 582.089349][ T7373] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 582.100521][ T7373] dvb-usb: bulk message failed: -22 (6/0) [ 582.106583][ T7373] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 582.129681][ T7373] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input105 [ 582.143621][ T7373] dvb-usb: schedule remote query interval to 150 msecs. [ 582.154988][ T7373] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 582.308112][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 582.320124][ T7373] dvb-usb: error while querying for an remote control event. [ 582.488037][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 582.493836][ T7373] dvb-usb: error while querying for an remote control event. [ 582.678062][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 582.683923][ T7373] dvb-usb: error while querying for an remote control event. [ 582.774059][T18250] futex_wake_op: syz.0.1951 tries to shift op by -33; fix this program [ 582.847791][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 582.853960][ T7373] dvb-usb: error while querying for an remote control event. [ 583.035177][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 583.041202][ T7373] dvb-usb: error while querying for an remote control event. [ 583.207897][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 583.214373][ T5890] dvb-usb: error while querying for an remote control event. [ 583.377883][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 583.383782][ T5890] dvb-usb: error while querying for an remote control event. [ 583.554005][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 583.559944][ T5890] dvb-usb: error while querying for an remote control event. [ 583.728564][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 583.734554][ T5890] dvb-usb: error while querying for an remote control event. [ 583.792163][T18255] netlink: 'syz.4.1957': attribute type 1 has an invalid length. [ 583.928583][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 583.934545][ T7373] dvb-usb: error while querying for an remote control event. [ 584.108472][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 584.114462][ T5837] dvb-usb: error while querying for an remote control event. [ 584.137885][ T5890] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 584.192653][T18279] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1963'. [ 584.277861][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 584.318118][ T7373] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 584.333390][ T5890] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 584.348653][ T5837] dvb-usb: error while querying for an remote control event. [ 584.365757][ T7394] usb 3-1: USB disconnect, device number 30 [ 584.388239][ T5890] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 584.420181][ T5890] usb 5-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 584.467850][ T7373] usb 1-1: device descriptor read/64, error -71 [ 584.484905][ T7394] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 584.565911][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.617386][ T5890] usb 5-1: config 0 descriptor?? [ 584.637132][T18260] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 584.907814][ T7373] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 585.107778][ T7373] usb 1-1: device descriptor read/64, error -71 [ 585.288459][ T5890] glorious 0003:22D4:1503.0059: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.4-1/input0 [ 585.347852][ T7373] usb usb1-port1: attempt power cycle [ 585.484457][T18325] "syz.3.1967" (18325) uses obsolete ecb(arc4) skcipher [ 585.503934][T18325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.530141][T18325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.767998][ T7373] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 585.789604][ T7373] usb 1-1: device descriptor read/8, error -71 [ 586.107849][ T7373] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 586.138290][ T7373] usb 1-1: device descriptor read/8, error -71 [ 586.259277][ T7373] usb usb1-port1: unable to enumerate USB device [ 586.316674][T18331] netlink: 'syz.3.1968': attribute type 1 has an invalid length. [ 586.919383][ T120] usb 5-1: USB disconnect, device number 32 [ 587.214071][T18363] futex_wake_op: syz.3.1970 tries to shift op by -33; fix this program [ 587.738881][ T7394] hid-generic 0000:0003:0000.005A: item fetching failed at offset 0/2 [ 587.751345][ T7394] hid-generic 0000:0003:0000.005A: probe with driver hid-generic failed with error -22 [ 587.846140][T18384] netlink: 'syz.0.1975': attribute type 12 has an invalid length. [ 587.864959][T18384] netlink: 'syz.0.1975': attribute type 29 has an invalid length. [ 588.215781][T18384] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1975'. [ 588.348004][T18384] netlink: 59 bytes leftover after parsing attributes in process `syz.0.1975'. [ 588.458024][ T7394] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 588.612374][ T7394] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.630302][ T7394] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 588.687835][ T7394] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 588.717148][ T7394] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.773552][ T7394] usb 1-1: config 0 descriptor?? [ 588.823271][ T7394] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 588.899493][ T7394] dvb-usb: bulk message failed: -22 (3/0) [ 588.930804][ T7394] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 588.971319][ T7394] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 588.992189][ T7394] usb 1-1: media controller created [ 589.002775][ T7394] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 589.118503][ T7394] dvb-usb: bulk message failed: -22 (6/0) [ 589.175171][ T7394] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 589.207623][ T7394] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input106 [ 589.275861][ T7394] dvb-usb: schedule remote query interval to 150 msecs. [ 589.293557][ T7394] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 589.311936][T18410] netlink: 'syz.2.1980': attribute type 1 has an invalid length. [ 589.417402][T18414] "syz.4.1979" (18414) uses obsolete ecb(arc4) skcipher [ 589.448257][ T7394] dvb-usb: bulk message failed: -22 (1/0) [ 589.458249][ T7394] dvb-usb: error while querying for an remote control event. [ 589.612112][T18422] netlink: 'syz.2.1991': attribute type 1 has an invalid length. [ 589.629733][ T7394] dvb-usb: bulk message failed: -22 (1/0) [ 589.655087][ T7394] dvb-usb: error while querying for an remote control event. [ 589.818171][ T5890] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 589.842722][ T7394] dvb-usb: bulk message failed: -22 (1/0) [ 589.860711][ T7394] dvb-usb: error while querying for an remote control event. [ 590.158125][ T7394] dvb-usb: bulk message failed: -22 (1/0) [ 590.276213][ T7394] dvb-usb: error while querying for an remote control event. [ 590.298897][ T5890] usb 5-1: config 0 has no interfaces? [ 590.428141][ T7394] usb 1-1: USB disconnect, device number 29 [ 590.436944][ T5890] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 590.522866][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.691214][ T7394] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 590.700133][ T5890] usb 5-1: Product: syz [ 590.704597][ T5890] usb 5-1: Manufacturer: syz [ 590.711229][ T5890] usb 5-1: SerialNumber: syz [ 590.736916][ T5890] usb 5-1: config 0 descriptor?? [ 590.812137][T18453] FAULT_INJECTION: forcing a failure. [ 590.812137][T18453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 590.858001][T18453] CPU: 1 UID: 0 PID: 18453 Comm: syz.0.1984 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 590.858035][T18453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 590.858048][T18453] Call Trace: [ 590.858057][T18453] [ 590.858066][T18453] dump_stack_lvl+0x241/0x360 [ 590.858103][T18453] ? __pfx_dump_stack_lvl+0x10/0x10 [ 590.858131][T18453] ? __pfx__printk+0x10/0x10 [ 590.858164][T18453] should_fail_ex+0x424/0x570 [ 590.858198][T18453] _copy_to_user+0x31/0xb0 [ 590.858225][T18453] simple_read_from_buffer+0xc4/0x170 [ 590.858258][T18453] proc_fail_nth_read+0x1ef/0x260 [ 590.858285][T18453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 590.858310][T18453] ? rw_verify_area+0x246/0x630 [ 590.858335][T18453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 590.858360][T18453] vfs_read+0x21f/0xb90 [ 590.858388][T18453] ? __pfx___mutex_lock+0x10/0x10 [ 590.858407][T18453] ? __pfx_vfs_read+0x10/0x10 [ 590.858446][T18453] ? __fget_files+0x2a/0x420 [ 590.858469][T18453] ? __fget_files+0x39d/0x420 [ 590.858490][T18453] ? __fget_files+0x2a/0x420 [ 590.858518][T18453] ksys_read+0x19d/0x2d0 [ 590.858546][T18453] ? __pfx_ksys_read+0x10/0x10 [ 590.858573][T18453] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 590.858603][T18453] ? lockdep_hardirqs_on+0x9d/0x150 [ 590.858632][T18453] __do_fast_syscall_32+0xb4/0x110 [ 590.858652][T18453] ? exc_page_fault+0x599/0x8b0 [ 590.858681][T18453] do_fast_syscall_32+0x34/0x80 [ 590.858700][T18453] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 590.858722][T18453] RIP: 0023:0xf7fe4579 [ 590.858739][T18453] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 590.858755][T18453] RSP: 002b:00000000f5106590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 590.858776][T18453] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5106620 [ 590.858790][T18453] RDX: 000000000000000f RSI: 00000000f746cff4 RDI: 0000000000000000 [ 590.858802][T18453] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 590.858813][T18453] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 590.858825][T18453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 590.858847][T18453] [ 591.413633][T18456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.448134][T18456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 592.702152][ T10] usb 5-1: USB disconnect, device number 33 [ 593.552882][T18489] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1992'. [ 593.788662][T18501] netlink: 'syz.2.1993': attribute type 1 has an invalid length. [ 593.961332][T18507] futex_wake_op: syz.0.1988 tries to shift op by -33; fix this program [ 594.050379][T18510] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1995'. [ 594.082169][T18510] bond1: entered promiscuous mode [ 594.088359][T18510] 8021q: adding VLAN 0 to HW filter on device bond1 [ 595.570406][T18564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 595.581289][T18564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 596.283145][T18577] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 596.447825][ T10] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 596.758152][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 596.765776][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 596.773505][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 596.783257][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.807823][T18581] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2001'. [ 596.823558][T18588] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2002'. [ 596.849956][ T30] audit: type=1804 audit(1743395804.030:2616): pid=18581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2001" name="bus" dev="ramfs" ino=39320 res=1 errno=0 [ 596.896683][ T10] usb 5-1: config 0 descriptor?? [ 596.915754][ T10] usb 5-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 597.062287][ T10] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 597.170798][ T10] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 597.178779][T18598] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1999'. [ 597.246748][ T10] usb 5-1: media controller created [ 597.328399][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 597.707555][ T5837] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 597.770634][T18609] netlink: 'syz.0.2004': attribute type 1 has an invalid length. [ 597.884750][ T5837] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 597.911414][ T5837] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 597.948311][ T5837] usb 3-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 597.974898][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.018149][ T5837] usb 3-1: config 0 descriptor?? [ 598.171408][T18602] raw-gadget.5 gadget.2: fail, usb_ep_enable returned -22 [ 598.378395][ T5890] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 598.564527][ T5890] usb 1-1: config 0 has no interfaces? [ 598.593498][ T5890] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 598.705375][ T5837] glorious 0003:22D4:1503.005B: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.2-1/input0 [ 598.724856][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.757782][ T5890] usb 1-1: Product: syz [ 598.870856][ T5890] usb 1-1: Manufacturer: syz [ 598.923103][ T5890] usb 1-1: SerialNumber: syz [ 598.941700][ T5890] usb 1-1: config 0 descriptor?? [ 599.203970][ T10] set interface failed [ 599.204009][ T10] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 599.411174][ T10] error writing reg: 0xff, val: 0x00 [ 599.505437][ T10] dvb_usb_mxl111sf 5-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 599.538888][ T10] usb 5-1: USB disconnect, device number 34 [ 600.379622][ T10] usb 3-1: USB disconnect, device number 31 [ 600.647381][T18674] "syz.5.2009" (18674) uses obsolete ecb(arc4) skcipher [ 601.352447][ T5837] usb 1-1: USB disconnect, device number 30 [ 602.569756][T18712] netlink: 'syz.4.2016': attribute type 1 has an invalid length. [ 602.748385][T18720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 602.767246][T18720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.417812][ T10] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 603.602426][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 603.613956][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 603.625524][ T10] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 603.636439][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.648831][ T10] usb 1-1: config 0 descriptor?? [ 604.078090][T18730] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 604.676329][ T10] glorious 0003:22D4:1503.005C: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.0-1/input0 [ 604.838346][ T5837] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 605.082268][ T5837] usb 5-1: config 0 has no interfaces? [ 605.099549][ T5837] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 605.110515][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.119144][ T5837] usb 5-1: Product: syz [ 605.123440][ T5837] usb 5-1: Manufacturer: syz [ 605.128162][ T5837] usb 5-1: SerialNumber: syz [ 605.146444][ T5837] usb 5-1: config 0 descriptor?? [ 605.582110][T18767] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2025'. [ 605.884249][T18778] netlink: 'syz.3.2027': attribute type 1 has an invalid length. [ 605.894766][T18779] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2028'. [ 606.282507][ T10] usb 1-1: USB disconnect, device number 31 [ 606.556301][T18811] "syz.0.2032" (18811) uses obsolete ecb(arc4) skcipher [ 606.819623][ T10] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 607.487161][ T10] usb 1-1: config 0 has no interfaces? [ 607.505953][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 607.551830][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.641126][ T10] usb 1-1: Product: syz [ 607.705631][ T10] usb 1-1: Manufacturer: syz [ 607.716243][ T10] usb 1-1: SerialNumber: syz [ 607.737120][ T10] usb 1-1: config 0 descriptor?? [ 608.152066][T18826] FAULT_INJECTION: forcing a failure. [ 608.152066][T18826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 608.196438][ T5837] usb 5-1: USB disconnect, device number 35 [ 608.203024][T18826] CPU: 1 UID: 0 PID: 18826 Comm: syz.3.2034 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 608.203055][T18826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 608.203070][T18826] Call Trace: [ 608.203078][T18826] [ 608.203087][T18826] dump_stack_lvl+0x241/0x360 [ 608.203127][T18826] ? __pfx_dump_stack_lvl+0x10/0x10 [ 608.203167][T18826] ? __pfx__printk+0x10/0x10 [ 608.203203][T18826] should_fail_ex+0x424/0x570 [ 608.203241][T18826] _copy_from_user+0x2d/0xb0 [ 608.203273][T18826] get_compat_msghdr+0xb3/0x730 [ 608.203303][T18826] ? __pfx_get_compat_msghdr+0x10/0x10 [ 608.203333][T18826] ? do_recvmmsg+0x566/0xab0 [ 608.203355][T18826] do_recvmmsg+0x4d5/0xab0 [ 608.203382][T18826] ? __pfx_do_recvmmsg+0x10/0x10 [ 608.203416][T18826] ? rcu_read_lock_any_held+0xbb/0x160 [ 608.203457][T18826] ? ksys_write+0x24e/0x2d0 [ 608.203506][T18826] __sys_recvmmsg+0x1aa/0x280 [ 608.203537][T18826] ? fput+0x9b/0xd0 [ 608.203556][T18826] ? __pfx___sys_recvmmsg+0x10/0x10 [ 608.203582][T18826] ? ksys_write+0x275/0x2d0 [ 608.203610][T18826] __ia32_compat_sys_recvmmsg_time32+0xbf/0xd0 [ 608.203637][T18826] __do_fast_syscall_32+0xb4/0x110 [ 608.203656][T18826] ? exc_page_fault+0x599/0x8b0 [ 608.203683][T18826] do_fast_syscall_32+0x34/0x80 [ 608.203700][T18826] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 608.203722][T18826] RIP: 0023:0xf7fc7579 [ 608.203736][T18826] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 608.203752][T18826] RSP: 002b:00000000f50c555c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 608.203770][T18826] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0 [ 608.203785][T18826] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 608.203798][T18826] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 608.203809][T18826] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 608.203819][T18826] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 608.203839][T18826] [ 608.414436][ C1] vkms_vblank_simulate: vblank timer overrun [ 608.997862][ T5837] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 609.148991][ T5837] usb 5-1: device descriptor read/64, error -71 [ 609.418063][ T5837] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 609.568238][ T5837] usb 5-1: device descriptor read/64, error -71 [ 609.644296][ T5890] usb 1-1: USB disconnect, device number 32 [ 609.702216][ T5837] usb usb5-port1: attempt power cycle [ 609.714575][T18869] futex_wake_op: syz.5.2038 tries to shift op by -33; fix this program [ 609.766808][T18871] netlink: 'syz.0.2041': attribute type 1 has an invalid length. [ 609.898095][ T7373] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 610.049023][ T5837] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 610.057838][ T7373] usb 3-1: Using ep0 maxpacket: 32 [ 610.059875][ T7373] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 610.059908][ T7373] usb 3-1: config 0 has no interface number 0 [ 610.059952][ T7373] usb 3-1: config 0 interface 184 has no altsetting 0 [ 610.061865][ T7373] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 610.061898][ T7373] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.061921][ T7373] usb 3-1: Product: syz [ 610.061937][ T7373] usb 3-1: Manufacturer: syz [ 610.061954][ T7373] usb 3-1: SerialNumber: syz [ 610.074271][ T7373] usb 3-1: config 0 descriptor?? [ 610.077319][ T7373] smsc75xx v1.0.0 [ 610.078879][ T5837] usb 5-1: device descriptor read/8, error -71 [ 610.331038][ T5837] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 610.349484][ T5837] usb 5-1: device descriptor read/8, error -71 [ 610.468592][ T5837] usb usb5-port1: unable to enumerate USB device [ 610.537026][ T7373] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 610.557393][ T7373] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 610.568149][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 610.588018][ T7373] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 610.618275][ T7373] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -61 [ 610.742269][ T10] usb 1-1: config 0 has no interfaces? [ 610.767512][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 610.804748][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.834920][ T10] usb 1-1: Product: syz [ 610.846451][ T10] usb 1-1: Manufacturer: syz [ 610.869762][ T10] usb 1-1: SerialNumber: syz [ 610.984441][ T10] usb 1-1: config 0 descriptor?? [ 611.183141][T18899] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 611.660655][T18917] "syz.5.2047" (18917) uses obsolete ecb(arc4) skcipher [ 612.919317][ T10] usb 3-1: USB disconnect, device number 32 [ 613.318185][ T120] usb 1-1: USB disconnect, device number 33 [ 613.507510][T18952] netlink: 'syz.2.2053': attribute type 1 has an invalid length. [ 613.687537][T18963] "syz.4.2051" (18963) uses obsolete ecb(arc4) skcipher [ 613.833188][ T5890] hid-generic 0000:0003:0000.005D: item fetching failed at offset 0/2 [ 613.841741][ T7373] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 613.851576][ T5890] hid-generic 0000:0003:0000.005D: probe with driver hid-generic failed with error -22 [ 613.923107][T18972] netlink: 'syz.0.2052': attribute type 12 has an invalid length. [ 613.939914][T18972] netlink: 'syz.0.2052': attribute type 29 has an invalid length. [ 613.948146][ T5837] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 613.961353][T18972] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2052'. [ 613.981970][T18972] netlink: 59 bytes leftover after parsing attributes in process `syz.0.2052'. [ 614.013689][ T7373] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 614.024166][ T7373] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 614.041432][ T7373] usb 3-1: New USB device found, idVendor=1b96, idProduct=0003, bcdDevice= 0.00 [ 614.063456][ T7373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=2 [ 614.072628][ T7373] usb 3-1: SerialNumber: syz [ 614.101964][ T7373] usb 3-1: config 0 descriptor?? [ 614.121987][ T5837] usb 5-1: config 0 has no interfaces? [ 614.161937][ T5837] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 614.191058][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.227694][ T5837] usb 5-1: Product: syz [ 614.233514][ T5837] usb 5-1: Manufacturer: syz [ 614.241578][ T5890] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 614.271002][ T5837] usb 5-1: SerialNumber: syz [ 614.282178][ T5837] usb 5-1: config 0 descriptor?? [ 614.435121][ T5890] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 614.446032][ T5890] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 614.479462][ T5890] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 614.521379][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.612113][ T5890] usb 1-1: config 0 descriptor?? [ 614.659711][ T5890] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 614.684110][ T5890] dvb-usb: bulk message failed: -22 (3/0) [ 614.728111][ T5890] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 614.768965][ T5890] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 614.801829][ T5890] usb 1-1: media controller created [ 614.808478][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 614.837875][ T5890] dvb-usb: bulk message failed: -22 (6/0) [ 614.859644][ T5890] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 614.873874][ T5890] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input107 [ 614.900323][ T5890] dvb-usb: schedule remote query interval to 150 msecs. [ 614.908128][ T5890] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 615.067749][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 615.123190][ T5890] dvb-usb: error while querying for an remote control event. [ 615.270215][T19012] FAULT_INJECTION: forcing a failure. [ 615.270215][T19012] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 615.344182][T19012] CPU: 1 UID: 0 PID: 19012 Comm: syz.3.2058 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 615.344218][T19012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 615.344233][T19012] Call Trace: [ 615.344241][T19012] [ 615.344252][T19012] dump_stack_lvl+0x241/0x360 [ 615.344293][T19012] ? __pfx_dump_stack_lvl+0x10/0x10 [ 615.344323][T19012] ? __pfx__printk+0x10/0x10 [ 615.344357][T19012] should_fail_ex+0x424/0x570 [ 615.344394][T19012] _copy_to_user+0x31/0xb0 [ 615.344425][T19012] simple_read_from_buffer+0xc4/0x170 [ 615.344450][T19012] proc_fail_nth_read+0x1ef/0x260 [ 615.344478][T19012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 615.344507][T19012] ? rw_verify_area+0x246/0x630 [ 615.344545][T19012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 615.344571][T19012] vfs_read+0x21f/0xb90 [ 615.344603][T19012] ? __pfx___mutex_lock+0x10/0x10 [ 615.344626][T19012] ? __pfx_vfs_read+0x10/0x10 [ 615.344657][T19012] ? __fget_files+0x2a/0x420 [ 615.344683][T19012] ? __fget_files+0x39d/0x420 [ 615.344707][T19012] ? __fget_files+0x2a/0x420 [ 615.344738][T19012] ksys_read+0x19d/0x2d0 [ 615.344769][T19012] ? __pfx_ksys_read+0x10/0x10 [ 615.344801][T19012] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 615.344835][T19012] ? lockdep_hardirqs_on+0x9d/0x150 [ 615.344869][T19012] __do_fast_syscall_32+0xb4/0x110 [ 615.344892][T19012] ? exc_page_fault+0x599/0x8b0 [ 615.344926][T19012] do_fast_syscall_32+0x34/0x80 [ 615.344947][T19012] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 615.344974][T19012] RIP: 0023:0xf7fc7579 [ 615.344992][T19012] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 615.345011][T19012] RSP: 002b:00000000f50c5590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 615.345034][T19012] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f50c5620 [ 615.345050][T19012] RDX: 000000000000000f RSI: 00000000f744cff4 RDI: 0000000000000000 [ 615.345063][T19012] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 615.345076][T19012] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 615.345089][T19012] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 615.345114][T19012] [ 615.693572][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 615.699444][ T5890] dvb-usb: error while querying for an remote control event. [ 615.857808][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 615.871221][ T5890] dvb-usb: error while querying for an remote control event. [ 615.924394][T19017] futex_wake_op: syz.5.2056 tries to shift op by -33; fix this program [ 616.048670][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 616.054594][ T5890] dvb-usb: error while querying for an remote control event. [ 616.067399][T19020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 616.107506][T19020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 616.228151][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 616.234015][ T5890] dvb-usb: error while querying for an remote control event. [ 616.400315][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 616.406312][ T5890] dvb-usb: error while querying for an remote control event. [ 616.416056][ T5837] usb 5-1: USB disconnect, device number 40 [ 616.610939][ T120] usb 3-1: USB disconnect, device number 33 [ 616.628183][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 616.634000][ T5890] dvb-usb: error while querying for an remote control event. [ 616.678342][ T5890] usb 1-1: USB disconnect, device number 34 [ 616.758783][ T5890] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 616.797514][T19060] netlink: 'syz.0.2064': attribute type 1 has an invalid length. [ 617.045305][T19072] "syz.0.2067" (19072) uses obsolete ecb(arc4) skcipher [ 617.319547][ T5890] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 617.342201][T19078] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2068'. [ 617.495804][ T5890] usb 1-1: config 0 has no interfaces? [ 617.508554][ T5890] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 617.537152][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.555725][ T5890] usb 1-1: Product: syz [ 617.570206][ T5890] usb 1-1: Manufacturer: syz [ 617.577113][ T5890] usb 1-1: SerialNumber: syz [ 617.594476][ T5890] usb 1-1: config 0 descriptor?? [ 618.511466][T19123] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 619.279786][T19128] futex_wake_op: syz.4.2072 tries to shift op by -33; fix this program [ 619.311566][T19127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 619.325955][T19127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.588634][ T5890] hid-generic 0000:0003:0000.005E: item fetching failed at offset 0/2 [ 619.602738][ T5890] hid-generic 0000:0003:0000.005E: probe with driver hid-generic failed with error -22 [ 619.908997][ T5890] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 620.005236][ T5837] usb 1-1: USB disconnect, device number 35 [ 620.062439][T19157] netlink: 'syz.0.2077': attribute type 1 has an invalid length. [ 620.159535][ T5890] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 620.181485][ T5890] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 620.193172][ T5890] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 620.206514][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.230699][ T5890] usb 3-1: config 0 descriptor?? [ 620.250487][ T5890] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 620.257261][ T5890] dvb-usb: bulk message failed: -22 (3/0) [ 620.285241][ T5890] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 620.296567][ T5890] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 620.310851][ T5890] usb 3-1: media controller created [ 620.317566][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 620.337488][ T5890] dvb-usb: bulk message failed: -22 (6/0) [ 620.344772][ T5890] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 620.353699][ T5890] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input108 [ 620.378149][ T5890] dvb-usb: schedule remote query interval to 150 msecs. [ 620.385167][ T5890] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 620.547872][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 620.553889][ T5890] dvb-usb: error while querying for an remote control event. [ 620.557816][ T120] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 620.717795][ T120] usb 1-1: Using ep0 maxpacket: 8 [ 620.724851][ T120] usb 1-1: unable to get BOS descriptor or descriptor too short [ 620.728137][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 620.735315][ T120] usb 1-1: config 11 has an invalid interface number: 204 but max is 0 [ 620.743818][ T5890] dvb-usb: error while querying for an remote control event. [ 620.747307][ T120] usb 1-1: config 11 has no interface number 0 [ 620.761896][ T120] usb 1-1: config 11 interface 204 altsetting 5 endpoint 0xE has invalid wMaxPacketSize 0 [ 620.772383][ T120] usb 1-1: config 11 interface 204 has no altsetting 0 [ 620.781242][ T120] usb 1-1: New USB device found, idVendor=20f4, idProduct=624d, bcdDevice=f9.eb [ 620.791198][ T120] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.799405][ T120] usb 1-1: Product: syz [ 620.803781][ T120] usb 1-1: Manufacturer: ꊭ㢵慬吾䖿᫬룄懙嶭㼳곴♔鿛娧껵陌꺀⇟ⵃ떆ꭵ屏怭轋㛾✕鏥㎰␮䫫毵血嬗뎾䷳̨佟്㹪怍灍૵潌㹋ｑ횽䮇쉕炣䞙졝綉ṥႮ㩞獷࿭胏⮛欭 [ 620.826615][ T120] usb 1-1: SerialNumber: syz [ 620.908357][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 620.914200][ T5890] dvb-usb: error while querying for an remote control event. [ 621.047168][ T120] usb 1-1: USB disconnect, device number 36 [ 621.089524][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 621.095971][ T5890] dvb-usb: error while querying for an remote control event. [ 621.258223][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 621.264026][ T5890] dvb-usb: error while querying for an remote control event. [ 621.431832][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 621.437749][ T5890] dvb-usb: error while querying for an remote control event. [ 621.598362][ T5890] dvb-usb: bulk message failed: -22 (1/0) [ 621.604374][ T5890] dvb-usb: error while querying for an remote control event. [ 621.746945][T19205] FAULT_INJECTION: forcing a failure. [ 621.746945][T19205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 621.761208][T19205] CPU: 0 UID: 0 PID: 19205 Comm: syz.4.2083 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 621.761241][T19205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 621.761255][T19205] Call Trace: [ 621.761272][T19205] [ 621.761283][T19205] dump_stack_lvl+0x241/0x360 [ 621.761321][T19205] ? __pfx_dump_stack_lvl+0x10/0x10 [ 621.761352][T19205] ? __pfx__printk+0x10/0x10 [ 621.761389][T19205] should_fail_ex+0x424/0x570 [ 621.761426][T19205] _copy_to_user+0x31/0xb0 [ 621.761456][T19205] simple_read_from_buffer+0xc4/0x170 [ 621.761480][T19205] proc_fail_nth_read+0x1ef/0x260 [ 621.761511][T19205] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 621.761539][T19205] ? rw_verify_area+0x246/0x630 [ 621.761567][T19205] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 621.761591][T19205] vfs_read+0x21f/0xb90 [ 621.761617][T19205] ? __pfx___mutex_lock+0x10/0x10 [ 621.761635][T19205] ? __pfx_vfs_read+0x10/0x10 [ 621.761660][T19205] ? __fget_files+0x2a/0x420 [ 621.761682][T19205] ? __fget_files+0x39d/0x420 [ 621.761701][T19205] ? __fget_files+0x2a/0x420 [ 621.761726][T19205] ksys_read+0x19d/0x2d0 [ 621.761751][T19205] ? __pfx_ksys_read+0x10/0x10 [ 621.761777][T19205] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 621.761813][T19205] ? lockdep_hardirqs_on+0x9d/0x150 [ 621.761841][T19205] __do_fast_syscall_32+0xb4/0x110 [ 621.761859][T19205] ? exc_page_fault+0x599/0x8b0 [ 621.761886][T19205] do_fast_syscall_32+0x34/0x80 [ 621.761904][T19205] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 621.761925][T19205] RIP: 0023:0xf740d579 [ 621.761941][T19205] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 621.761957][T19205] RSP: 002b:00000000f5096590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 621.761976][T19205] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5096620 [ 621.761989][T19205] RDX: 000000000000000f RSI: 00000000f73fcff4 RDI: 0000000000000000 [ 621.762000][T19205] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 621.762017][T19205] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 621.762028][T19205] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 621.762053][T19205] [ 621.990503][ C0] vkms_vblank_simulate: vblank timer overrun [ 621.996694][ T5837] dvb-usb: bulk message failed: -22 (1/0) [ 622.002720][ T5837] dvb-usb: error while querying for an remote control event. [ 622.078173][ T5890] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 622.167893][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 622.177606][ T7373] dvb-usb: error while querying for an remote control event. [ 622.239451][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 622.258499][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 622.287719][ T5890] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 622.296858][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.331850][ T5890] usb 1-1: config 0 descriptor?? [ 622.338169][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 622.343959][ T7373] dvb-usb: error while querying for an remote control event. [ 622.354526][T19198] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 622.479118][T19217] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2085'. [ 622.496088][T19217] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 622.517883][ T7373] dvb-usb: bulk message failed: -22 (1/0) [ 622.523807][ T7373] dvb-usb: error while querying for an remote control event. [ 622.563089][ T120] usb 3-1: USB disconnect, device number 34 [ 622.971684][ T120] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 623.170164][ T5890] glorious 0003:22D4:1503.005F: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.0-1/input0 [ 623.198949][T19226] PM: Enabling pm_trace changes system date and time during resume. [ 623.198949][T19226] PM: Correct system time has to be restored manually after resume. [ 623.245655][T19221] bridge0: port 3(team0) entered disabled state [ 623.252363][T19221] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.259893][T19221] bridge0: port 1(bridge_slave_0) entered disabled state [ 623.506431][T19263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2087'. [ 623.552063][T19260] netlink: 'syz.4.2088': attribute type 1 has an invalid length. [ 623.552900][T19221] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 623.634787][T19221] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 623.876747][T19221] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.905233][T19221] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.920247][T19221] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.932411][T19221] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 624.056123][T19221] vlan2: left promiscuous mode [ 624.098577][T19221] vlan1: left promiscuous mode [ 624.108261][T19221] bond1: left promiscuous mode [ 624.204539][T19277] futex_wake_op: syz.3.2089 tries to shift op by -33; fix this program [ 624.351542][T19280] IPVS: dh: TCP 172.20.20.170:0 - no destination available [ 624.440640][T19245] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 624.483297][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.489790][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.649439][T19245] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 624.673570][T19245] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 624.713129][T19245] usb 5-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 624.750564][T19245] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.795618][T19245] usb 5-1: config 0 descriptor?? [ 625.165196][ T7394] usb 1-1: USB disconnect, device number 37 [ 625.228406][T19245] logitech 0003:046D:CA04.0060: hidraw0: USB HID v0.00 Device [HID 046d:ca04] on usb-dummy_hcd.4-1/input0 [ 625.281557][T19245] logitech 0003:046D:CA04.0060: no inputs found [ 625.479083][T19325] "syz.0.2094" (19325) uses obsolete ecb(arc4) skcipher [ 625.758365][ T5889] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 626.074223][ T5889] usb 1-1: config 0 has no interfaces? [ 626.084107][ T5889] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 626.094040][ T5889] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.108136][ T5889] usb 1-1: Product: syz [ 626.430657][ T5889] usb 1-1: Manufacturer: syz [ 626.451080][ T5889] usb 1-1: SerialNumber: syz [ 626.511056][ T5889] usb 1-1: config 0 descriptor?? [ 626.727923][ T7394] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 626.857114][T19268] usb 5-1: USB disconnect, device number 41 [ 626.879512][ T7394] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 626.892934][ T7394] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 626.945248][ T7394] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 627.012270][ T7394] usb 3-1: Product: syz [ 627.016974][ T7394] usb 3-1: Manufacturer: syz [ 627.038068][ T7394] usb 3-1: SerialNumber: syz [ 627.051336][ T7394] usb 3-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 627.268015][T19268] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 627.440127][T19268] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 627.455088][T19268] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 627.484762][T19268] usb 5-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 627.496701][T19268] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 627.535651][T19268] usb 5-1: config 0 descriptor?? [ 627.543906][T19363] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 627.877055][ T7394] usb 3-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 627.903424][ T7394] usb 3-1: USB disconnect, device number 35 [ 627.975364][T19268] glorious 0003:22D4:1503.0061: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.4-1/input0 [ 628.190357][T19268] usb 1-1: USB disconnect, device number 38 [ 628.253634][T19404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 628.263515][T19404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.587816][T19268] usb 1-1: new full-speed USB device number 39 using dummy_hcd [ 628.749779][T19268] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 628.784978][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 47999, setting to 64 [ 628.813189][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 628.866412][T19268] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 628.895387][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.912033][T19268] usb 1-1: Product: syz [ 628.916255][T19268] usb 1-1: Manufacturer: syz [ 628.933207][T19268] usb 1-1: SerialNumber: syz [ 628.958398][T19268] usb 1-1: config 0 descriptor?? [ 628.964113][T19399] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 629.013092][T19268] option 1-1:0.0: GSM modem (1-port) converter detected [ 629.218327][T19445] futex_wake_op: syz.5.2108 tries to shift op by -33; fix this program [ 629.343366][T19399] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.350754][T19399] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.418040][T19268] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 629.591797][T19268] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 629.594314][T19399] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 629.602996][T19268] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 629.603045][T19268] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 629.603071][T19268] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.639406][T19434] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 629.660330][T19399] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 629.713714][T19399] veth1_vlan: left allmulticast mode [ 629.713724][T19268] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 629.856170][T19399] batadv0: left allmulticast mode [ 629.862245][T19399] macvtap1: left allmulticast mode [ 629.882110][T19399] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.905023][T19399] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.920327][T19399] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.038402][T19399] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.115929][T19249] usb 5-1: USB disconnect, device number 42 [ 630.132337][T19399] geneve2: left allmulticast mode [ 630.316652][T19249] usb 1-1: USB disconnect, device number 39 [ 630.324463][T19249] option 1-1:0.0: device disconnected [ 630.598558][T19245] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 630.767720][T19245] usb 5-1: Using ep0 maxpacket: 16 [ 630.776821][T19245] usb 5-1: config 0 has no interfaces? [ 630.793605][T19245] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 630.813843][T19245] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.830707][T19245] usb 5-1: Product: syz [ 630.846839][T19245] usb 5-1: Manufacturer: syz [ 630.857386][T19245] usb 5-1: SerialNumber: syz [ 630.874885][T19245] usb 5-1: config 0 descriptor?? [ 631.205406][T19268] usb 5-1: USB disconnect, device number 43 [ 631.638723][T19512] "syz.3.2113" (19512) uses obsolete ecb(arc4) skcipher [ 631.651210][T19512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.660372][T19512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.265945][T19268] usb 3-1: USB disconnect, device number 36 [ 632.422953][T19543] netlink: 'syz.2.2116': attribute type 11 has an invalid length. [ 632.627808][T19245] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 632.758451][T19245] usb 5-1: device descriptor read/64, error -71 [ 632.759916][T19268] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 632.967727][T19268] usb 3-1: Invalid ep0 maxpacket: 9 [ 633.007788][T19245] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 633.107906][T19268] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 633.156122][T19245] usb 5-1: device descriptor read/64, error -71 [ 633.268460][T19245] usb usb5-port1: attempt power cycle [ 633.298710][T19268] usb 3-1: Invalid ep0 maxpacket: 9 [ 633.334907][T19268] usb usb3-port1: attempt power cycle [ 633.491770][T19560] FAULT_INJECTION: forcing a failure. [ 633.491770][T19560] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 633.515097][T19560] CPU: 1 UID: 0 PID: 19560 Comm: syz.0.2118 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 633.515132][T19560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 633.515146][T19560] Call Trace: [ 633.515156][T19560] [ 633.515166][T19560] dump_stack_lvl+0x241/0x360 [ 633.515205][T19560] ? __pfx_dump_stack_lvl+0x10/0x10 [ 633.515236][T19560] ? __pfx__printk+0x10/0x10 [ 633.515273][T19560] should_fail_ex+0x424/0x570 [ 633.515311][T19560] _copy_to_user+0x31/0xb0 [ 633.515342][T19560] simple_read_from_buffer+0xc4/0x170 [ 633.515369][T19560] proc_fail_nth_read+0x1ef/0x260 [ 633.515399][T19560] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 633.515429][T19560] ? rw_verify_area+0x246/0x630 [ 633.515458][T19560] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 633.515487][T19560] vfs_read+0x21f/0xb90 [ 633.515519][T19560] ? __pfx___mutex_lock+0x10/0x10 [ 633.515541][T19560] ? __pfx_vfs_read+0x10/0x10 [ 633.515571][T19560] ? __fget_files+0x2a/0x420 [ 633.515596][T19560] ? __fget_files+0x39d/0x420 [ 633.515616][T19560] ? __fget_files+0x2a/0x420 [ 633.515640][T19560] ksys_read+0x19d/0x2d0 [ 633.515665][T19560] ? __pfx_ksys_read+0x10/0x10 [ 633.515689][T19560] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 633.515717][T19560] ? lockdep_hardirqs_on+0x9d/0x150 [ 633.515744][T19560] __do_fast_syscall_32+0xb4/0x110 [ 633.515762][T19560] ? exc_page_fault+0x599/0x8b0 [ 633.515789][T19560] do_fast_syscall_32+0x34/0x80 [ 633.515806][T19560] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 633.515834][T19560] RIP: 0023:0xf7fe4579 [ 633.515848][T19560] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 633.515864][T19560] RSP: 002b:00000000f50c4590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 633.515883][T19560] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000f50c4620 [ 633.515895][T19560] RDX: 000000000000000f RSI: 00000000f746cff4 RDI: 0000000000000000 [ 633.515907][T19560] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 633.515916][T19560] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 633.515927][T19560] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 633.515946][T19560] [ 633.740196][ C1] vkms_vblank_simulate: vblank timer overrun [ 633.746508][T19245] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 634.067730][T19268] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 634.101600][T19245] usb 5-1: device descriptor read/8, error -71 [ 634.118641][T19268] usb 3-1: Invalid ep0 maxpacket: 9 [ 634.257992][T19268] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 634.298465][T19268] usb 3-1: Invalid ep0 maxpacket: 9 [ 634.304076][T19268] usb usb3-port1: unable to enumerate USB device [ 634.388166][T19245] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 634.601044][T19245] usb 5-1: device descriptor read/8, error -71 [ 634.718804][T19245] usb usb5-port1: unable to enumerate USB device [ 636.023959][T19598] futex_wake_op: syz.5.2121 tries to shift op by -33; fix this program [ 636.127927][T19268] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 636.319921][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 636.348446][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 636.372872][T19268] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 636.414231][T19268] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.433537][T19605] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2126'. [ 636.458312][T19268] usb 1-1: config 0 descriptor?? [ 636.470247][T19590] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 636.890045][T19268] glorious 0003:22D4:1503.0062: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.0-1/input0 [ 636.932800][T19249] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 637.220468][T19597] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2125'. [ 637.257805][T19597] netlink: 2940 bytes leftover after parsing attributes in process `syz.2.2125'. [ 637.267269][T19597] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2125'. [ 637.276638][T19249] usb 5-1: device descriptor read/64, error -71 [ 637.657763][T19249] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 637.797944][T19249] usb 5-1: device descriptor read/64, error -71 [ 637.918234][T19249] usb usb5-port1: attempt power cycle [ 637.943336][T19638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.994487][T19638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.034259][T19638] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2128'. [ 638.074014][T19638] loop6: detected capacity change from 0 to 524287999 [ 638.086623][T18900] loop: Write error at byte offset 1, length 4096. [ 638.104354][T18900] loop: Write error at byte offset 1, length 4096. [ 638.164535][ C1] I/O error, dev loop6, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 2 prio class 0 [ 638.174100][ C1] buffer_io_error: 6 callbacks suppressed [ 638.174116][ C1] Buffer I/O error on dev loop6, logical block 0, lost async page write [ 638.188335][ C1] Buffer I/O error on dev loop6, logical block 1, lost async page write [ 638.196790][ C1] I/O error, dev loop6, sector 16 op 0x0:(READ) flags 0x80700 phys_seg 3 prio class 0 [ 638.208274][ C1] I/O error, dev loop6, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 638.215632][T19638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.217543][ C1] Buffer I/O error on dev loop6, logical block 2, async page read [ 638.234024][ C1] I/O error, dev loop6, sector 24 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 638.243296][ C1] Buffer I/O error on dev loop6, logical block 3, async page read [ 638.259555][T19638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.288234][T19249] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 638.318140][T19268] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 638.336381][T19249] usb 5-1: device descriptor read/8, error -71 [ 638.477989][T19268] usb 3-1: Using ep0 maxpacket: 8 [ 638.486105][T19268] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 638.503486][T19268] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 638.533202][T19268] usb 3-1: config 0 has no interface number 0 [ 638.545911][T19268] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 638.583451][T19268] usb 3-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 638.611438][T19249] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 638.638506][T19249] usb 5-1: device descriptor read/8, error -71 [ 638.768517][T19249] usb usb5-port1: unable to enumerate USB device [ 638.971771][T19268] usb 3-1: config 0 interface 52 has no altsetting 0 [ 639.004264][T19268] usb 3-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 639.013678][T19268] usb 3-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 639.027189][T19268] usb 3-1: Manufacturer: syz [ 639.035082][T19268] usb 3-1: config 0 descriptor?? [ 639.076704][ T5889] usb 1-1: USB disconnect, device number 40 [ 639.259259][T19268] input: syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.52/input/input111 [ 639.516318][T19268] usb 3-1: USB disconnect, device number 41 [ 639.522675][ C1] synaptics_usb 3-1:0.52: synusb_irq - usb_submit_urb failed with result: -19 [ 640.358188][T19268] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 640.588293][T19268] usb 5-1: Using ep0 maxpacket: 8 [ 640.617827][T19268] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 56832, setting to 1024 [ 640.649304][T19268] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 640.674538][T19268] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 640.692048][T19268] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 640.742702][T19268] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 640.757686][T19268] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.843259][T19737] FAULT_INJECTION: forcing a failure. [ 640.843259][T19737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 640.862821][T19737] CPU: 0 UID: 0 PID: 19737 Comm: syz.3.2141 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 640.862853][T19737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 640.862866][T19737] Call Trace: [ 640.862874][T19737] [ 640.862883][T19737] dump_stack_lvl+0x241/0x360 [ 640.862916][T19737] ? __pfx_dump_stack_lvl+0x10/0x10 [ 640.862947][T19737] ? __pfx__printk+0x10/0x10 [ 640.862985][T19737] should_fail_ex+0x424/0x570 [ 640.863019][T19737] _copy_from_user+0x2d/0xb0 [ 640.863046][T19737] snd_seq_write+0x323/0xac0 [ 640.863072][T19737] ? __pfx_snd_seq_write+0x10/0x10 [ 640.863092][T19737] ? bpf_lsm_file_permission+0x9/0x10 [ 640.863118][T19737] ? rw_verify_area+0x246/0x630 [ 640.863146][T19737] ? __pfx_snd_seq_write+0x10/0x10 [ 640.863170][T19737] vfs_write+0x2bc/0xd10 [ 640.863203][T19737] ? __pfx_vfs_write+0x10/0x10 [ 640.863229][T19737] ? __fget_files+0x2a/0x420 [ 640.863247][T19737] ? __fget_files+0x2a/0x420 [ 640.863273][T19737] ? __fget_files+0x39d/0x420 [ 640.863297][T19737] ? __fget_files+0x2a/0x420 [ 640.863325][T19737] ksys_write+0x19d/0x2d0 [ 640.863354][T19737] ? __pfx_ksys_write+0x10/0x10 [ 640.863376][T19737] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 640.863400][T19737] ? lockdep_hardirqs_on+0x9d/0x150 [ 640.863434][T19737] __do_fast_syscall_32+0xb4/0x110 [ 640.863456][T19737] ? exc_page_fault+0x599/0x8b0 [ 640.863487][T19737] do_fast_syscall_32+0x34/0x80 [ 640.863505][T19737] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 640.863528][T19737] RIP: 0023:0xf7fc7579 [ 640.863544][T19737] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 640.863575][T19737] RSP: 002b:00000000f50e655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 640.863601][T19737] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 640.863616][T19737] RDX: 000000000001001a RSI: 0000000000000000 RDI: 0000000000000000 [ 640.863630][T19737] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 640.863642][T19737] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 640.863654][T19737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 640.863677][T19737] [ 641.191029][T19740] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2135'. [ 641.216124][T19268] usb 5-1: GET_CAPABILITIES returned 0 [ 641.334513][T19268] usbtmc 5-1:16.0: can't read capabilities [ 641.558777][T19755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 641.588863][T19755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 641.675038][T19268] usb 5-1: USB disconnect, device number 52 [ 641.996178][T19772] futex_wake_op: syz.0.2139 tries to shift op by -33; fix this program [ 642.068423][T19245] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 642.263778][T19245] usb 3-1: Using ep0 maxpacket: 32 [ 642.284374][T19245] usb 3-1: config 0 interface 0 has no altsetting 0 [ 642.297829][T19249] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 642.316718][T19245] usb 3-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 642.365214][T19245] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.389385][T19245] usb 3-1: config 0 descriptor?? [ 642.410760][T19245] usb 3-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 642.443715][T19245] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 642.468075][T19249] usb 5-1: Using ep0 maxpacket: 32 [ 642.482776][T19249] usb 5-1: config 0 interface 0 has no altsetting 0 [ 642.490136][T19245] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 642.496849][T19249] usb 5-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 642.506096][T19245] usb 3-1: media controller created [ 642.515895][T19249] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.538169][T19245] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 642.555373][T19249] usb 5-1: config 0 descriptor?? [ 642.588694][T19249] usb 5-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 642.635843][T19249] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 642.654386][T19249] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 642.662600][T19249] usb 5-1: media controller created [ 642.695766][T19790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2143'. [ 642.724429][T19249] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 642.781076][T19790] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2143'. [ 642.866324][T19795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2144'. [ 642.894844][T19795] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2144'. [ 643.344142][T19801] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 644.856824][T19245] set interface failed [ 644.856885][T19245] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 644.903723][T19245] error writing reg: 0xff, val: 0x00 [ 644.950354][T19245] dvb_usb_mxl111sf 3-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 644.985481][T19245] usb 3-1: USB disconnect, device number 42 [ 645.042828][T19249] set interface failed [ 645.042867][T19249] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 645.057195][T19249] error writing reg: 0xff, val: 0x00 [ 645.092155][T19249] dvb_usb_mxl111sf 5-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 645.118329][T19249] usb 5-1: USB disconnect, device number 53 [ 646.475971][T19881] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2156'. [ 647.048861][T19249] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 647.157144][T19909] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2161'. [ 647.198058][T19249] usb 5-1: Using ep0 maxpacket: 32 [ 647.214012][T19249] usb 5-1: config 0 interface 0 has no altsetting 0 [ 647.221106][T19249] usb 5-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 647.231024][T19249] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.247123][T19249] usb 5-1: config 0 descriptor?? [ 647.266193][T19249] usb 5-1: dvb_usb_v2: found a 'HCW 126xxx' in warm state [ 647.292103][T19249] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 647.330078][T19917] futex_wake_op: syz.0.2157 tries to shift op by -33; fix this program [ 647.444610][T19249] dvbdev: DVB: registering new adapter (HCW 126xxx) [ 647.478227][T19249] usb 5-1: media controller created [ 647.540421][T19249] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 647.559828][T19920] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2159'. [ 647.578077][T19920] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2159'. [ 648.138147][T19268] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 648.289383][T19268] usb 1-1: config 9 has an invalid interface number: 129 but max is 0 [ 648.299667][T19268] usb 1-1: config 9 has no interface number 0 [ 648.306065][T19268] usb 1-1: config 9 interface 129 has no altsetting 0 [ 648.316129][T19268] usb 1-1: New USB device found, idVendor=0af0, idProduct=d013, bcdDevice=e9.f7 [ 648.326327][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.335318][T19268] usb 1-1: Product: syz [ 648.341251][T19268] usb 1-1: Manufacturer: syz [ 648.346033][T19268] usb 1-1: SerialNumber: syz [ 648.575720][T19268] usb 1-1: USB disconnect, device number 41 [ 649.747799][T19268] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 649.843282][T19249] set interface failed [ 649.843320][T19249] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 649.930241][T19969] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2168'. [ 649.961944][T19249] error writing reg: 0xff, val: 0x00 [ 650.022909][T19268] usb 1-1: config 0 has no interfaces? [ 650.061586][T19268] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 650.062727][T19249] dvb_usb_mxl111sf 5-1:0.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 650.088321][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.118451][T19268] usb 1-1: Product: syz [ 650.128079][T19268] usb 1-1: Manufacturer: syz [ 650.135469][T19249] usb 5-1: USB disconnect, device number 54 [ 650.172200][T19268] usb 1-1: SerialNumber: syz [ 650.191387][T19268] usb 1-1: config 0 descriptor?? [ 650.428198][T19996] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2169'. [ 650.448057][T19245] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 650.617746][T19245] usb 3-1: device descriptor read/64, error -71 [ 650.698005][T19268] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 650.857768][T19268] usb 5-1: device descriptor read/64, error -71 [ 650.857849][T19245] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 650.998063][T19245] usb 3-1: device descriptor read/64, error -71 [ 651.108693][T19245] usb usb3-port1: attempt power cycle [ 651.147773][T19268] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 651.317842][T19268] usb 5-1: device descriptor read/64, error -71 [ 651.362681][T20008] futex_wake_op: syz.5.2172 tries to shift op by -33; fix this program [ 651.452131][T19268] usb usb5-port1: attempt power cycle [ 651.508147][T19245] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 651.556529][T19245] usb 3-1: device descriptor read/8, error -71 [ 651.807944][T19268] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 651.829007][T19268] usb 5-1: device descriptor read/8, error -71 [ 651.897798][T19245] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 651.928038][T19245] usb 3-1: device descriptor read/8, error -71 [ 652.048280][T19245] usb usb3-port1: unable to enumerate USB device [ 652.108118][T19268] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 652.187560][T19268] usb 5-1: device descriptor read/8, error -71 [ 652.348099][T19268] usb usb5-port1: unable to enumerate USB device [ 652.506659][T19268] usb 1-1: USB disconnect, device number 42 [ 652.714211][T20025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.723132][T20025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 654.338373][T20076] "syz.2.2185" (20076) uses obsolete ecb(arc4) skcipher [ 654.598227][T19245] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 654.768997][T19245] usb 3-1: config 0 has no interfaces? [ 654.805216][T19245] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 654.854373][T19245] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.864610][T19245] usb 3-1: Product: syz [ 654.869395][T19245] usb 3-1: Manufacturer: syz [ 654.874721][T19245] usb 3-1: SerialNumber: syz [ 654.979330][T19245] usb 3-1: config 0 descriptor?? [ 655.352378][T20083] futex_wake_op: syz.5.2183 tries to shift op by -33; fix this program [ 655.907762][T19245] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 655.995225][T20103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.012550][T20104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.026124][T20103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.037502][T20104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.102599][T19245] usb 5-1: Using ep0 maxpacket: 8 [ 656.142392][T19245] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 656.210092][T19245] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 656.283878][T19245] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 656.354136][T19245] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 656.387766][T19245] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 656.546658][T19245] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.851368][T19245] usb 5-1: GET_CAPABILITIES returned 0 [ 656.863851][T19245] usbtmc 5-1:16.0: can't read capabilities [ 657.038118][T20122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.065247][T20122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.091802][T19268] usb 5-1: USB disconnect, device number 59 [ 657.284583][T19245] usb 3-1: USB disconnect, device number 47 [ 657.409280][T20152] FAULT_INJECTION: forcing a failure. [ 657.409280][T20152] name failslab, interval 1, probability 0, space 0, times 0 [ 657.422527][T20152] CPU: 1 UID: 0 PID: 20152 Comm: syz.0.2197 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 657.422558][T20152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 657.422572][T20152] Call Trace: [ 657.422581][T20152] [ 657.422591][T20152] dump_stack_lvl+0x241/0x360 [ 657.422627][T20152] ? __pfx_dump_stack_lvl+0x10/0x10 [ 657.422656][T20152] ? __pfx__printk+0x10/0x10 [ 657.422687][T20152] ? __pfx___might_resched+0x10/0x10 [ 657.422715][T20152] should_fail_ex+0x424/0x570 [ 657.422759][T20152] should_failslab+0xac/0x100 [ 657.422782][T20152] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 657.422806][T20152] ? __alloc_skb+0x1c2/0x480 [ 657.422836][T20152] __alloc_skb+0x1c2/0x480 [ 657.422866][T20152] ? __pfx___alloc_skb+0x10/0x10 [ 657.422949][T20152] ? netlink_autobind+0xd6/0x2f0 [ 657.422972][T20152] ? netlink_autobind+0x2b0/0x2f0 [ 657.422998][T20152] netlink_sendmsg+0x638/0xcd0 [ 657.423028][T20152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 657.423053][T20152] ? aa_sock_msg_perm+0x91/0x160 [ 657.423082][T20152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 657.423104][T20152] __sock_sendmsg+0x221/0x270 [ 657.423128][T20152] __sys_sendto+0x365/0x4c0 [ 657.423156][T20152] ? __pfx___sys_sendto+0x10/0x10 [ 657.423205][T20152] __se_compat_sys_socketcall+0xad6/0x1420 [ 657.423235][T20152] ? __pfx___se_compat_sys_socketcall+0x10/0x10 [ 657.423264][T20152] ? ksys_write+0x275/0x2d0 [ 657.423314][T20152] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 657.423346][T20152] ? lockdep_hardirqs_on+0x9d/0x150 [ 657.423377][T20152] __do_fast_syscall_32+0xb4/0x110 [ 657.423398][T20152] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 657.423419][T20152] ? lockdep_hardirqs_on+0x9d/0x150 [ 657.423451][T20152] do_fast_syscall_32+0x34/0x80 [ 657.423470][T20152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 657.423502][T20152] RIP: 0023:0xf7fe4579 [ 657.423519][T20152] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 657.423538][T20152] RSP: 002b:00000000f5105430 EFLAGS: 00000206 ORIG_RAX: 0000000000000066 [ 657.423560][T20152] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f5105444 [ 657.423574][T20152] RDX: 0000000000000000 RSI: 00000000f5105560 RDI: 00000000f746cff4 [ 657.423589][T20152] RBP: 00000000f5105560 R08: 0000000000000000 R09: 0000000000000000 [ 657.423602][T20152] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 657.423614][T20152] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 657.423638][T20152] [ 657.847864][T19245] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 657.970824][T20170] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 657.978452][T19245] usb 3-1: device descriptor read/64, error -71 [ 657.978853][T20170] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 658.077791][T19268] usb 5-1: new full-speed USB device number 60 using dummy_hcd [ 658.227866][T19245] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 658.228125][T19268] usb 5-1: device descriptor read/64, error -71 [ 658.371527][T19245] usb 3-1: device descriptor read/64, error -71 [ 658.478038][T19268] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 658.492238][T19245] usb usb3-port1: attempt power cycle [ 658.507440][T20178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 658.517244][ T30] audit: type=1326 audit(1743395865.730:2617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 658.540218][T20178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 658.638262][ T30] audit: type=1326 audit(1743395865.730:2618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 658.698047][T19268] usb 5-1: device descriptor read/64, error -71 [ 658.770185][ T30] audit: type=1326 audit(1743395865.730:2619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 658.813879][ T30] audit: type=1326 audit(1743395865.730:2620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 658.871558][ T30] audit: type=1326 audit(1743395865.780:2621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 658.871621][T19268] usb usb5-port1: attempt power cycle [ 658.971688][T19245] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 658.981643][ T30] audit: type=1326 audit(1743395865.780:2622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 659.015522][ T30] audit: type=1326 audit(1743395865.780:2623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 659.038550][T19245] usb 3-1: device descriptor read/8, error -71 [ 659.127102][ T30] audit: type=1326 audit(1743395865.780:2624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 659.244761][ T30] audit: type=1326 audit(1743395865.780:2625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 659.278708][T19245] usb 3-1: new full-speed USB device number 51 using dummy_hcd [ 659.288204][T19268] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 659.325280][T19268] usb 5-1: device descriptor read/8, error -71 [ 659.330252][T19245] usb 3-1: device descriptor read/8, error -71 [ 659.366995][ T30] audit: type=1326 audit(1743395865.780:2626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20175 comm="syz.3.2203" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7579 code=0x7ffc0000 [ 659.458023][T19245] usb usb3-port1: unable to enumerate USB device [ 659.587842][T19268] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 659.622286][T19268] usb 5-1: device descriptor read/8, error -71 [ 659.749034][T19268] usb usb5-port1: unable to enumerate USB device [ 659.977851][T19245] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 660.131495][T19245] usb 1-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 660.147307][T19245] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.168697][T19245] usb 1-1: config 0 descriptor?? [ 660.190650][T20210] "syz.5.2206" (20210) uses obsolete ecb(arc4) skcipher [ 660.581643][T19245] hackrf 1-1:0.0: usb_control_msg() failed -71 request 0f [ 660.591600][T19245] hackrf 1-1:0.0: Could not detect board [ 660.602248][T19245] hackrf 1-1:0.0: probe with driver hackrf failed with error -71 [ 660.612873][T19245] usb 1-1: USB disconnect, device number 43 [ 661.088931][T20245] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 661.126418][T19245] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 661.298955][T19245] usb 3-1: Using ep0 maxpacket: 8 [ 661.438163][T19268] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 661.472312][T19245] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 661.517513][T19245] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 661.855936][T19268] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 661.868910][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 47999, setting to 64 [ 661.892805][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 661.918240][T19245] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 661.936002][T19245] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 661.951332][T19268] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 661.961932][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.977369][T19268] usb 1-1: Product: syz [ 661.984787][T19268] usb 1-1: Manufacturer: syz [ 661.990297][T19268] usb 1-1: SerialNumber: syz [ 662.202283][T19245] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 662.218754][T19268] usb 1-1: config 0 descriptor?? [ 662.224287][T20247] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 662.242149][T19268] option 1-1:0.0: GSM modem (1-port) converter detected [ 662.280156][T19245] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.645951][T19245] usb 3-1: GET_CAPABILITIES returned 0 [ 662.648611][T19268] usb 1-1: USB disconnect, device number 44 [ 662.657953][T19245] usbtmc 3-1:16.0: can't read capabilities [ 662.662183][T19268] option 1-1:0.0: device disconnected [ 662.824279][T20245] syz.4.2211 (20245): drop_caches: 2 [ 662.857875][T19245] usb 3-1: USB disconnect, device number 52 [ 663.676977][T20301] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 663.827600][T20308] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 664.701334][T20331] fuse: Bad value for 'fd' [ 665.397557][T20346] "syz.4.2228" (20346) uses obsolete ecb(arc4) skcipher [ 665.423174][T19245] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 665.590467][T19245] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 665.648132][T19249] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 665.736734][T19245] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 47999, setting to 64 [ 665.799691][T19245] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 665.838809][T19245] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 665.848545][T19245] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.871162][T19245] usb 1-1: Product: syz [ 665.924734][T19249] usb 5-1: config 0 has no interfaces? [ 665.931129][T19245] usb 1-1: Manufacturer: syz [ 665.935772][T19245] usb 1-1: SerialNumber: syz [ 665.998959][T19249] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 666.032001][T19245] usb 1-1: config 0 descriptor?? [ 666.044237][T20340] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 666.053288][T19249] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.085287][T19245] option 1-1:0.0: GSM modem (1-port) converter detected [ 666.121122][T19249] usb 5-1: Product: syz [ 666.125369][T19249] usb 5-1: Manufacturer: syz [ 666.167374][T19249] usb 5-1: SerialNumber: syz [ 666.191398][T20366] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.206723][T20366] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.227273][T19249] usb 5-1: config 0 descriptor?? [ 666.344194][T20381] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2233'. [ 666.606114][ T5889] usb 1-1: USB disconnect, device number 45 [ 666.616877][ T5889] option 1-1:0.0: device disconnected [ 668.584300][ T5889] usb 5-1: USB disconnect, device number 64 [ 668.706961][T20411] futex_wake_op: syz.0.2236 tries to shift op by -33; fix this program [ 669.289547][T20441] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2241'. [ 669.321423][T20441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 669.331117][T20441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 670.917912][T19268] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 670.942398][T20468] futex_wake_op: syz.4.2244 tries to shift op by -33; fix this program [ 671.123092][T19268] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 671.135163][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 47999, setting to 64 [ 671.165563][T19268] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 671.194384][T19268] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 671.213442][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.246712][T19268] usb 1-1: Product: syz [ 671.299894][T19268] usb 1-1: Manufacturer: syz [ 671.305780][T19268] usb 1-1: SerialNumber: syz [ 671.339514][T19268] usb 1-1: config 0 descriptor?? [ 671.346291][T20458] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 671.498647][T19268] option 1-1:0.0: GSM modem (1-port) converter detected [ 671.665292][T19268] usb 1-1: USB disconnect, device number 46 [ 671.672902][T19268] option 1-1:0.0: device disconnected [ 671.781887][T20487] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 672.270654][T20487] syz.2.2247 (20487): drop_caches: 2 [ 672.934541][T20497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 672.983265][T20497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.019545][T20497] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2249'. [ 673.061344][T20497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.084721][T20497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.958748][T20537] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2258'. [ 673.977000][T20537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.985954][T20537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.328175][ T5889] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 674.537695][ T5889] usb 3-1: Using ep0 maxpacket: 32 [ 674.705928][ T5889] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 674.725820][ T5889] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.809236][ T5889] usb 3-1: Product: syz [ 674.813583][ T5889] usb 3-1: Manufacturer: syz [ 674.825004][ T5889] usb 3-1: SerialNumber: syz [ 675.026200][ T5889] usb 3-1: config 0 descriptor?? [ 675.041896][ T5889] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 675.271343][ T5889] gspca_ov534_9: reg_w failed -71 [ 675.538200][T19268] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 675.709374][T19268] usb 1-1: config 0 has an invalid interface number: 46 but max is 0 [ 675.733784][T19268] usb 1-1: config 0 has no interface number 0 [ 675.744087][T19268] usb 1-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 675.761760][T19268] usb 1-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 675.771433][ T5889] gspca_ov534_9: Unknown sensor 0000 [ 675.771488][ T5889] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 675.789719][T19268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.817771][ T5889] usb 3-1: USB disconnect, device number 53 [ 675.824626][T19268] usb 1-1: Product: syz [ 675.839089][T19268] usb 1-1: Manufacturer: syz [ 675.847438][T19268] usb 1-1: SerialNumber: syz [ 675.859609][T19268] usb 1-1: config 0 descriptor?? [ 675.879042][T19268] ums-karma 1-1:0.46: USB Mass Storage device detected [ 675.969406][T19268] ums-karma 1-1:0.46: probe with driver ums-karma failed with error -5 [ 676.193974][T20584] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.221041][T20584] syz.2.2262 (20584): drop_caches: 2 [ 676.265058][T20585] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2263'. [ 676.537765][ T5889] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 676.710339][ T5889] usb 5-1: device descriptor read/64, error -71 [ 677.077789][ T5889] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 677.217905][ T5889] usb 5-1: device descriptor read/64, error -71 [ 677.318750][T20601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 677.337367][T20601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 677.358003][ T5889] usb usb5-port1: attempt power cycle [ 677.778051][ T5889] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 677.818716][ T5889] usb 5-1: device descriptor read/8, error -71 [ 678.068152][ T5889] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 678.088637][ T5889] usb 5-1: device descriptor read/8, error -71 [ 678.208747][ T5889] usb usb5-port1: unable to enumerate USB device [ 678.270358][T19245] usb 1-1: USB disconnect, device number 47 [ 679.228146][T19249] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 679.408197][T19249] usb 3-1: Using ep0 maxpacket: 8 [ 679.424248][T19249] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 679.455798][T19249] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 679.529158][T19249] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 679.568114][T19249] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 679.651324][T19249] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 679.727426][T19249] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.109838][T19249] usb 3-1: GET_CAPABILITIES returned 0 [ 680.115625][T19249] usbtmc 3-1:16.0: can't read capabilities [ 680.361463][ T5889] usb 3-1: USB disconnect, device number 54 [ 681.230467][T20702] futex_wake_op: syz.0.2275 tries to shift op by -33; fix this program [ 681.258478][T19249] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 681.317746][T19245] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 681.343049][ T30] kauditd_printk_skb: 621 callbacks suppressed [ 681.343066][ T30] audit: type=1326 audit(1743395888.570:3248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20698 comm="syz.5.2280" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744d579 code=0x7ffc0000 [ 681.477910][T19249] usb 3-1: device descriptor read/64, error -71 [ 681.531845][ T30] audit: type=1326 audit(1743395888.610:3249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20698 comm="syz.5.2280" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744d579 code=0x7ffc0000 [ 681.554652][ T30] audit: type=1326 audit(1743395888.740:3250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20698 comm="syz.5.2280" exe="/root/syz-executor" sig=0 arch=40000003 syscall=150 compat=1 ip=0xf744d579 code=0x7ffc0000 [ 681.558104][T19245] usb 5-1: Using ep0 maxpacket: 16 [ 681.668684][ T30] audit: type=1326 audit(1743395888.880:3251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20698 comm="syz.5.2280" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744d579 code=0x7ffc0000 [ 681.719072][ T30] audit: type=1326 audit(1743395888.880:3252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20698 comm="syz.5.2280" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744d579 code=0x7ffc0000 [ 681.753752][T19245] usb 5-1: config 10 has an invalid interface number: 165 but max is 0 [ 681.762327][T19249] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 681.804820][T19245] usb 5-1: config 10 has no interface number 0 [ 681.821197][T19245] usb 5-1: New USB device found, idVendor=0b48, idProduct=300d, bcdDevice=d4.cd [ 681.847403][T19245] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.880551][T19245] dvb-usb: found a 'Technotrend TT-connect CT-3650' in cold state, will try to load a firmware [ 681.891873][T19245] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 681.928074][T19249] usb 3-1: device descriptor read/64, error -71 [ 682.038214][T19249] usb usb3-port1: attempt power cycle [ 682.123961][T20689] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2279'. [ 682.144395][T20689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 682.153823][T20689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 682.167379][T19245] usb 5-1: USB disconnect, device number 69 [ 682.368071][ T5889] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 682.388020][T19249] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 682.408597][T19249] usb 3-1: device descriptor read/8, error -71 [ 682.517878][ T5889] usb 1-1: Using ep0 maxpacket: 8 [ 682.525173][ T5889] usb 1-1: config 9 has an invalid interface number: 14 but max is 0 [ 682.534486][ T5889] usb 1-1: config 9 has no interface number 0 [ 682.541701][ T5889] usb 1-1: config 9 interface 14 has no altsetting 0 [ 682.551449][ T5889] usb 1-1: New USB device found, idVendor=07ca, idProduct=a801, bcdDevice=44.64 [ 682.561881][ T5889] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.570350][ T5889] usb 1-1: Product: syz [ 682.574815][ T5889] usb 1-1: Manufacturer: syz [ 682.584226][ T5889] usb 1-1: SerialNumber: syz [ 682.595940][ T5889] dvb-usb: found a 'AVerMedia AverTV DVB-T USB 2.0 (A800)' in warm state. [ 682.626075][ T5889] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 682.636681][ T5889] dvbdev: DVB: registering new adapter (AVerMedia AverTV DVB-T USB 2.0 (A800)) [ 682.647051][ T5889] usb 1-1: media controller created [ 682.648334][T19249] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 682.665992][ T5889] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 682.682440][ T5889] dvb-usb: bulk message failed: -22 (6/0) [ 682.690491][T19249] usb 3-1: device descriptor read/8, error -71 [ 682.705533][ T5889] dvb-usb: bulk message failed: -22 (6/0) [ 682.712973][ T5889] dvb-usb: no frontend was attached by 'AVerMedia AverTV DVB-T USB 2.0 (A800)' [ 682.816569][T20744] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2284'. [ 682.833946][T19249] usb usb3-port1: unable to enumerate USB device [ 682.864437][T20738] futex_wake_op: syz.3.2284 tries to shift op by -1; fix this program [ 682.951573][ T5889] rc_core: IR keymap rc-avermedia-m135a not found [ 682.958660][ T5889] Registered IR keymap rc-empty [ 682.965043][ T5889] rc rc0: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 682.987355][ T5889] input: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input112 [ 683.008542][ T5889] dvb-usb: schedule remote query interval to 150 msecs. [ 683.017161][ T5889] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully initialized and connected. [ 683.048797][ T5889] usb 1-1: USB disconnect, device number 48 [ 683.103732][ T5889] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully deinitialized and disconnected. [ 684.289502][T20783] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2292'. [ 684.363135][T20795] "syz.5.2293" (20795) uses obsolete ecb(arc4) skcipher [ 684.488376][T19245] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 684.617904][T20805] "syz.4.2294" (20805) uses obsolete ecb(arc4) skcipher [ 684.658274][T19245] usb 1-1: Using ep0 maxpacket: 8 [ 684.664911][T19245] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 684.677143][T19245] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 684.700411][T19245] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 684.753866][T19245] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 684.775482][T19245] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 684.787160][T19245] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 684.924134][ T5889] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 685.028224][T19245] usb 1-1: GET_CAPABILITIES returned 0 [ 685.044288][T19245] usbtmc 1-1:16.0: can't read capabilities [ 685.106776][ T5889] usb 5-1: config 0 has no interfaces? [ 685.130005][ T5889] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 685.146561][ T5889] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.175037][ T5889] usb 5-1: Product: syz [ 685.189258][ T5889] usb 5-1: Manufacturer: syz [ 685.201567][ T5889] usb 5-1: SerialNumber: syz [ 685.210553][ T5889] usb 5-1: config 0 descriptor?? [ 685.294565][T19245] usb 1-1: USB disconnect, device number 49 [ 685.711494][T20837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 685.721563][T20837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 685.883927][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.890702][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.218203][T19245] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 686.463886][T19245] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 686.478282][T19245] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 47999, setting to 64 [ 686.633487][T19245] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 686.746772][T19245] usb 1-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 686.815583][T19245] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 686.844174][T19245] usb 1-1: Product: syz [ 686.852084][T19245] usb 1-1: Manufacturer: syz [ 686.875344][T19245] usb 1-1: SerialNumber: syz [ 686.891237][T19245] usb 1-1: config 0 descriptor?? [ 686.900030][T20844] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 686.911215][T19245] option 1-1:0.0: GSM modem (1-port) converter detected [ 686.928247][ T5889] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 687.128158][ T5889] usb 3-1: Using ep0 maxpacket: 32 [ 687.141961][T19245] usb 1-1: USB disconnect, device number 50 [ 687.152309][T19245] option 1-1:0.0: device disconnected [ 687.169598][ T5889] usb 3-1: config 0 interface 0 has no altsetting 0 [ 687.201159][ T5889] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 687.224549][ T5889] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.249365][ T5889] usb 3-1: Product: syz [ 687.258212][ T5889] usb 3-1: Manufacturer: syz [ 687.290856][ T5889] usb 3-1: SerialNumber: syz [ 687.320895][ T5889] usb 3-1: config 0 descriptor?? [ 687.633402][T19245] usb 5-1: USB disconnect, device number 70 [ 687.824178][ T30] audit: type=1326 audit(1743395895.050:3253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20880 comm="syz.5.2300" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744d579 code=0x7fc00000 [ 687.876653][ T5889] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 688.075880][ T5889] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 688.085157][ T5889] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -121 [ 688.280997][T20852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 688.293898][T20852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 688.324780][T20852] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2299'. [ 688.334098][T20852] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2299'. [ 688.444752][ T31] INFO: task kworker/0:17:7396 blocked for more than 143 seconds. [ 688.531188][ T31] Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 [ 688.538933][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 688.549580][ T31] task:kworker/0:17 state:D stack:20904 pid:7396 tgid:7396 ppid:2 task_flags:0x4288060 flags:0x00004000 [ 688.562955][ T31] Workqueue: usb_hub_wq hub_event [ 688.569679][ T31] Call Trace: [ 688.573166][ T31] [ 688.577316][ T31] __schedule+0x1b88/0x5240 [ 688.582097][ T31] ? __pfx_try_to_wake_up+0x10/0x10 [ 688.587530][ T31] ? schedule+0x163/0x360 [ 688.592516][ T31] ? __pfx___schedule+0x10/0x10 [ 688.597735][ T31] ? preempt_schedule+0xe4/0xf0 [ 688.628640][ T31] ? schedule+0x90/0x360 [ 688.641659][ T31] ? schedule+0x90/0x360 [ 688.645708][T20905] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 688.668022][ T31] schedule+0x163/0x360 [ 688.672447][ T31] schedule_timeout+0xb1/0x2b0 [ 688.701298][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 688.710929][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 688.717481][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 688.750986][ T31] ? wait_for_completion+0x2d4/0x600 [ 688.763211][ T31] wait_for_completion+0x32f/0x600 [ 688.789272][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 688.802860][ T31] i2c_del_adapter+0x5fd/0x770 [ 688.837746][ T31] ? kasan_quarantine_put+0xdc/0x230 [ 688.852926][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 688.868057][ T31] ? dvb_usb_adapter_exit+0xce/0x220 [ 688.886906][ T31] dvb_usb_i2c_exit+0x66/0xb0 [ 688.892762][ T31] dvb_usb_device_exit+0x1c7/0x360 [ 688.917353][ T31] ? _raw_spin_unlock_irqrestore+0x90/0x140 [ 688.937760][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 688.943052][ T31] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 688.964837][ T31] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 688.971684][ T31] ? usb_disable_interface+0x2b2/0x2f0 [ 688.981955][ T31] usb_unbind_interface+0x25b/0x940 [ 688.996226][ T31] ? kernfs_find_ns+0x2bf/0x340 [ 689.009379][ T31] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 689.016702][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 689.028066][ T31] device_release_driver_internal+0x503/0x7c0 [ 689.036930][ T31] bus_remove_device+0x34f/0x420 [ 689.048129][ T31] device_del+0x57c/0x9b0 [ 689.054838][ T31] ? __pm_runtime_barrier+0x230/0x510 [ 689.065336][ T31] ? __pfx_device_del+0x10/0x10 [ 689.071076][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 689.076862][ T31] usb_disable_device+0x3c5/0x860 [ 689.089435][ T31] usb_disconnect+0x340/0x960 [ 689.094304][ T31] hub_event+0x1d2a/0x50f0 [ 689.100688][T20907] futex_wake_op: syz.0.2304 tries to shift op by -33; fix this program [ 689.106959][ T31] ? do_raw_spin_unlock+0x13c/0x8b0 [ 689.115728][ T31] ? __pfx_hub_event+0x10/0x10 [ 689.125222][ T31] ? __lock_acquire+0xad5/0xd80 [ 689.133303][ T31] ? insn_get_displacement+0xf0/0x9a0 [ 689.145027][ T31] ? process_scheduled_works+0x9cb/0x18e0 [ 689.151455][ T31] process_scheduled_works+0xac3/0x18e0 [ 689.162779][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 689.170170][ T31] ? assign_work+0x367/0x3d0 [ 689.175615][ T31] worker_thread+0x870/0xd50 [ 689.185712][ T31] ? __kthread_parkme+0x1a8/0x200 [ 689.191964][ T31] ? __pfx_worker_thread+0x10/0x10 [ 689.202283][ T31] kthread+0x7b7/0x940 [ 689.207490][ T31] ? __pfx_worker_thread+0x10/0x10 [ 689.214151][ T31] ? __pfx_kthread+0x10/0x10 [ 689.224186][ T31] ? __pfx_kthread+0x10/0x10 [ 689.229660][ T31] ? __pfx_kthread+0x10/0x10 [ 689.235816][ T31] ? __pfx_kthread+0x10/0x10 [ 689.251237][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 689.256905][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 689.265500][ T31] ? __pfx_kthread+0x10/0x10 [ 689.274143][ T31] ret_from_fork+0x4b/0x80 [ 689.282297][ T31] ? __pfx_kthread+0x10/0x10 [ 689.295350][ T31] ret_from_fork_asm+0x1a/0x30 [ 689.413388][ T31] [ 689.416774][ T31] [ 689.416774][ T31] Showing all locks held in the system: [ 689.478194][ T31] 1 lock held by khungtaskd/31: [ 689.483317][T19245] usb 3-1: USB disconnect, device number 59 [ 689.493325][ T31] #0: ffffffff8ed3b3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x30/0x180 [ 689.523766][ T31] 2 locks held by kworker/u8:4/77: [ 689.543399][ T31] #0: ffff8880b8639b18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140 [ 689.565484][ T31] #1: ffffc90001567c60 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9cb/0x18e0 [ 689.600109][ T31] 2 locks held by getty/5592: [ 689.611658][ T31] #0: ffff8880352920a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 689.640153][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x53d/0x16b0 [ 689.673505][ T31] 5 locks held by kworker/0:17/7396: [ 689.688104][ T31] #0: ffff888144ea3148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x990/0x18e0 [ 689.718098][ T31] #1: ffffc9000498fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9cb/0x18e0 [ 689.748275][ T31] #2: ffff888028ba3190 (&dev->mutex){....}-{4:4}, at: hub_event+0x200/0x50f0 [ 689.765224][ T31] #3: ffff8880659da190 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x103/0x960 [ 689.792615][ T31] #4: ffff8880226ae160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xce/0x7c0 [ 689.818013][ T31] 2 locks held by syz.4.2302/20887: [ 689.830039][ T31] 1 lock held by syz.0.2304/20906: [ 689.843030][ T31] #0: ffff8880b8639b18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140 [ 689.856877][ T31] [ 689.860676][ T31] ============================================= [ 689.860676][ T31] [ 689.869769][ T31] NMI backtrace for cpu 0 [ 689.869789][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 689.869815][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 689.869829][ T31] Call Trace: [ 689.869837][ T31] [ 689.869846][ T31] dump_stack_lvl+0x241/0x360 [ 689.869883][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.869914][ T31] ? __pfx__printk+0x10/0x10 [ 689.869949][ T31] nmi_cpu_backtrace+0x4ab/0x4e0 [ 689.869981][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 689.870007][ T31] ? _printk+0xd5/0x120 [ 689.870034][ T31] ? __wake_up_klogd+0xcc/0x110 [ 689.870065][ T31] ? __pfx__printk+0x10/0x10 [ 689.870095][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 689.870118][ T31] nmi_trigger_cpumask_backtrace+0x198/0x320 [ 689.870149][ T31] watchdog+0x1058/0x10a0 [ 689.870171][ T31] ? watchdog+0x1ea/0x10a0 [ 689.870195][ T31] ? __pfx_watchdog+0x10/0x10 [ 689.870216][ T31] kthread+0x7b7/0x940 [ 689.870245][ T31] ? __pfx_watchdog+0x10/0x10 [ 689.870273][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870301][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870329][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870357][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870385][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 689.870413][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 689.870444][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870472][ T31] ret_from_fork+0x4b/0x80 [ 689.870494][ T31] ? __pfx_kthread+0x10/0x10 [ 689.870522][ T31] ret_from_fork_asm+0x1a/0x30 [ 689.870552][ T31] [ 689.870560][ T31] Sending NMI from CPU 0 to CPUs 1: [ 690.036072][ C1] NMI backtrace for cpu 1 [ 690.036091][ C1] CPU: 1 UID: 0 PID: 5853 Comm: syz-executor Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 690.036114][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 690.036125][ C1] RIP: 0010:memset_orig+0x25/0xb0 [ 690.036149][ C1] Code: 90 90 90 90 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01 48 0f af c1 41 89 f9 41 83 e1 07 75 74 48 89 d1 48 c1 e9 06 <74> 39 66 0f 1f 84 00 00 00 00 00 48 ff c9 48 89 07 48 89 47 08 48 [ 690.036165][ C1] RSP: 0018:ffffc90003eff498 EFLAGS: 00000247 [ 690.036182][ C1] RAX: 0000000000000000 RBX: ffffc90003eff560 RCX: 0000000000000000 [ 690.036195][ C1] RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003eff580 [ 690.036208][ C1] RBP: ffffc90003eff630 R08: ffffc90003eff5a7 R09: 0000000000000000 [ 690.036220][ C1] R10: ffffc90003eff580 R11: fffff520007dfeb5 R12: 0000000000000000 [ 690.036233][ C1] R13: ffffc90003eff568 R14: ffff88814d1badd0 R15: dffffc0000000000 [ 690.036247][ C1] FS: 0000000000000000(0000) GS:ffff8881250b1000(0063) knlGS:00000000574c0440 [ 690.036262][ C1] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 690.036274][ C1] CR2: 00000000f745d230 CR3: 00000000606a8000 CR4: 00000000003526f0 [ 690.036290][ C1] DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000 [ 690.036301][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 690.036312][ C1] Call Trace: [ 690.036319][ C1] [ 690.036327][ C1] ? nmi_cpu_backtrace+0x3d1/0x4e0 [ 690.036354][ C1] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 690.036376][ C1] ? look_up_lock_class+0x7b/0x170 [ 690.036404][ C1] ? lock_acquire+0x1fc/0x2f0 [ 690.036425][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 690.036444][ C1] ? nmi_handle+0x196/0x5e0 [ 690.036465][ C1] ? nmi_handle+0x7e/0x5e0 [ 690.036486][ C1] ? memset_orig+0x25/0xb0 [ 690.036503][ C1] ? default_do_nmi+0x63/0x160 [ 690.036524][ C1] ? exc_nmi+0x123/0x1f0 [ 690.036544][ C1] ? end_repeat_nmi+0xf/0x53 [ 690.036567][ C1] ? memset_orig+0x25/0xb0 [ 690.036589][ C1] ? memset_orig+0x25/0xb0 [ 690.036607][ C1] ? memset_orig+0x25/0xb0 [ 690.036624][ C1] [ 690.036631][ C1] [ 690.036637][ C1] __mutex_lock+0x11b/0x10c0 [ 690.036655][ C1] ? __lock_acquire+0xad5/0xd80 [ 690.036675][ C1] ? do_ip6t_get_ctl+0x79b/0x18c0 [ 690.036695][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 690.036719][ C1] do_ip6t_get_ctl+0x79b/0x18c0 [ 690.036756][ C1] ? __pfx_do_ip6t_get_ctl+0x10/0x10 [ 690.036776][ C1] ? __lock_acquire+0xad5/0xd80 [ 690.036797][ C1] ? __pfx___mutex_trylock_common+0x10/0x10 [ 690.036826][ C1] ? nf_getsockopt+0x248/0x2c0 [ 690.036849][ C1] ? __mutex_unlock_slowpath+0x229/0x800 [ 690.036870][ C1] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 690.036893][ C1] nf_getsockopt+0x299/0x2c0 [ 690.036917][ C1] ipv6_getsockopt+0x240/0x360 [ 690.036940][ C1] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 690.036964][ C1] ? aa_sk_perm+0x96f/0xac0 [ 690.036988][ C1] tcp_getsockopt+0x16f/0x1d0 [ 690.037010][ C1] ? __pfx_tcp_getsockopt+0x10/0x10 [ 690.037030][ C1] ? errseq_sample+0x40/0x70 [ 690.037054][ C1] ? aa_sock_opt_perm+0x79/0x120 [ 690.037077][ C1] ? sock_common_getsockopt+0x2e/0xb0 [ 690.037097][ C1] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 690.037119][ C1] do_sock_getsockopt+0x391/0x740 [ 690.037145][ C1] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 690.037171][ C1] ? __lock_acquire+0xad5/0xd80 [ 690.037192][ C1] __sys_getsockopt+0x24e/0x320 [ 690.037219][ C1] ? __pfx___sys_getsockopt+0x10/0x10 [ 690.037249][ C1] __se_compat_sys_socketcall+0x330/0x1420 [ 690.037274][ C1] ? kmem_cache_free+0x312/0x410 [ 690.037293][ C1] ? fput_close_sync+0x1ef/0x270 [ 690.037315][ C1] ? __pfx___se_compat_sys_socketcall+0x10/0x10 [ 690.037347][ C1] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 690.037374][ C1] ? lockdep_hardirqs_on+0x9d/0x150 [ 690.037401][ C1] __do_fast_syscall_32+0xb4/0x110 [ 690.037418][ C1] ? exc_page_fault+0x599/0x8b0 [ 690.037444][ C1] do_fast_syscall_32+0x34/0x80 [ 690.037461][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 690.037482][ C1] RIP: 0023:0xf7fd1579 [ 690.037495][ C1] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 690.037511][ C1] RSP: 002b:00000000f75bf650 EFLAGS: 00000206 ORIG_RAX: 0000000000000066 [ 690.037528][ C1] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000f75bf688 [ 690.037540][ C1] RDX: 00000000f75bf704 RSI: 00000000f75bf75c RDI: 00000000f745cff4 [ 690.037552][ C1] RBP: 00000000f745f8e8 R08: 0000000000000000 R09: 0000000000000000 [ 690.037563][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 690.037580][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 690.037601][ C1] [ 690.050888][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 690.050916][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(full) [ 690.050945][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 690.050960][ T31] Call Trace: [ 690.050970][ T31] [ 690.050981][ T31] dump_stack_lvl+0x241/0x360 [ 690.051022][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 690.051056][ T31] ? __pfx__printk+0x10/0x10 [ 690.051093][ T31] ? vscnprintf+0x5d/0x90 [ 690.051125][ T31] panic+0x349/0x880 [ 690.051154][ T31] ? __pfx_preempt_schedule+0x10/0x10 [ 690.051188][ T31] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 690.051220][ T31] ? __pfx_panic+0x10/0x10 [ 690.051248][ T31] ? tick_nohz_tick_stopped+0x82/0xb0 [ 690.051284][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 690.051310][ T31] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 690.051353][ T31] ? nmi_trigger_cpumask_backtrace+0x2d4/0x320 [ 690.051387][ T31] ? nmi_trigger_cpumask_backtrace+0x2d9/0x320 [ 690.051420][ T31] watchdog+0x1097/0x10a0 [ 690.051446][ T31] ? watchdog+0x1ea/0x10a0 [ 690.051472][ T31] ? __pfx_watchdog+0x10/0x10 [ 690.051496][ T31] kthread+0x7b7/0x940 [ 690.051530][ T31] ? __pfx_watchdog+0x10/0x10 [ 690.051554][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051584][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051615][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051646][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051677][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 690.051708][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 690.051742][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051776][ T31] ret_from_fork+0x4b/0x80 [ 690.051803][ T31] ? __pfx_kthread+0x10/0x10 [ 690.051835][ T31] ret_from_fork_asm+0x1a/0x30 [ 690.051870][ T31] [ 690.688162][ T31] Kernel Offset: disabled [ 690.692500][ T31] Rebooting in 86400 seconds..