last executing test programs: 11.184827498s ago: executing program 2 (id=552): ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x42, 0x9, 0x70bd27, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x44804}, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000060a010400000000000000000a0000030900010073797a31000000002400048020000180070001006374000014000280080002400000000108000140000000090900020073797a3200"], 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r2 = syz_open_dev$loop(&(0x7f0000000240), 0x6, 0x142b23) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/disk', 0x8a883, 0x12) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000080)={r3, 0x0, {0x0, 0x0, 0x0, 0x9, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cb2dc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0xff7, 0x1707]}}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000740)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000001fe8000000000000000000000000000bb00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000009a5ab6e10c00000000000000040000000000000000000000000000000000000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000000000000000001000000000000004400050000000000000000000000000000000000000000003c00000002000000ffffffff0002000000000000000000000600000004"], 0xfc}}, 0x0) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_extract_tcp_res$synack(&(0x7f0000000680)={0x41424344, 0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000006c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, r7, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) syz_emit_ethernet(0x62, &(0x7f0000000140)={@local, @random, @val={@void, {0x8100, 0x6, 0x1}}, {@ipv4={0x800, @tcp={{0xf, 0x4, 0x0, 0x0, 0x50, 0x64, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x24}, {[@rr={0x7, 0x13, 0xd2, [@multicast1, @multicast2, @private=0xa010102, @broadcast]}, @timestamp={0x44, 0xc, 0x6b, 0x3, 0x0, [0x7, 0x5]}, @cipso={0x86, 0x6, 0x3}]}}, {{0x0, 0xfffd, r7, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) sendmsg$nl_generic(r8, &(0x7f00000003c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0xe4, 0x1a, 0x400, 0x70bd2d, 0x25dfdbff, {0x1f}, [@generic="995eec58ae02d85596758511c774370e90e528c8be277fda245a499786212748212d6e16cbd863791dae174c26c51ad7b02436564e7e53f59a37e0ebe86235ccebe795e86f7f873cf2a5d65b82dfb3a65135c2b9aa88385285879bf93b9aa986e35d75d4f2ced7b119752c22e71e5ed858e6e5bc39c01baf3d2cbb94afeea4790aa4bb2aa18fb4b17e38dfce0d806191a82589005094c456b6d5dbbbc9c5146cb97e67f6bd30e8d6a81974c06b7675b18612720573d96efe9c32342942b984071b27997c791cbf94f512d522efe2b0"]}, 0xe4}, 0x1, 0x0, 0x0, 0x4000014}, 0x40) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0x16, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f0000000040)={0x48, 0x2, r11, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x872}) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, &(0x7f0000000040)) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b04101e8c00000001090212000100000000090401"], 0x0) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002000000202505a8a4400001020301090224000101109008091400010207010300090501020002080a01090582021000030506"], &(0x7f0000000200)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x300, 0xfc, 0x5, 0xc, 0x40, 0xdd}, 0xbf, &(0x7f0000000240)=ANY=[@ANYBLOB="050fbf00030b10010038000102030040a41002d5ef3562823b770359a8bfef765f4526fb20c3bcef4fd7454a1aab8a2074b6f8c68eaea4f91d7ccd7a36d443e78a58769aa0aa176c5cd24d95944026166c0b9758e831e3d26b96c3c374233bd48268b056a6a2dc04a47565c172af814cb184c410db54fd3acc12212a30c1f1e818bdfb831c8225d33a252a6b58f723ed257a285e8184795ae829240529a0d81b9538e4d68f2f3488fb53e80ef28678a1b5d47c211ea852992d75431bfd81e30b1001084c004009020009"], 0x1, [{0x55, &(0x7f0000000080)=@string={0x55, 0x3, "cae90eefcc0a97bbe676bcffb0fe9c43d1a6ad5aad42305b3716b822dab56c0d0f4083656139520315bc516a1662557a74189cb6def00aa02ba0ba7dbc56b6ebc262cc515ce8d1d668806ddd24098b07302c7c"}}]}) 9.694207772s ago: executing program 1 (id=565): socket(0x11, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd60820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f00001001"], 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) recvmsg$can_raw(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/165, 0xa5}], 0x1}, 0x20) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0002, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r3, &(0x7f0000004100)={0x2020}, 0x2020) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, &(0x7f0000000000)={0x18, r5, 0x1, 0x0, &(0x7f0000000100)=[{0x12df, 0x2000000000000003}]}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f00000000c0)={0x28, 0x4, r5, 0x0, &(0x7f0000000240)='7', 0x1, 0xfffffffffffff801}) setsockopt$inet6_int(r4, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r6}}, 0x58) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_IRQP_SET(r7, 0x4008700c, 0x37) r8 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x539741) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000040)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$RTC_PIE_ON(r7, 0x7005) 8.47150881s ago: executing program 4 (id=566): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x301400) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) r1 = fsopen(&(0x7f0000000080)='vfat\x00', 0x1) (async) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2080, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4010808}, 0xc, &(0x7f00000003c0)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_DELTABLE={0x12c, 0x2, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_USERDATA={0x100, 0x6, "db33a8e875c12051e165913e19097acf69f22d3fc84c971d5ebff4289aeb34692a62eaf6dd6da12e8faf7e715369c33bfc9197eb9eba727dbaa090d79b2cfb77f87cadcb71ad96d6b176c49ea533e28a9f052399735bc21e91fb53266fc79a81bac584387059b6fc7445c8aacde4309ab98a3113c26eae48794afb2565ac261d92ea55781833a34749a48d5137fabeb7a7d3fc64a52769fc298dcf8cefda36c6da7c85b273004ee0ba37ba9cd5fd12f4641a1632d18c480b8646409817b4970611a782494238387ddb4c212e810fc4f640486e6468601e4ad6e2628a18cdeea002ffaf241abffbad8ef29e927a1b24aebba6705be30debe594c1646c"}]}, @NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, @NFT_OBJECT_SYNPROXY=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWFLOWTABLE={0xec, 0x16, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_FLOWTABLE_HOOK={0xc0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'vcan0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xffba}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_macvtap\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'ip6gre0\x00'}, {0x14, 0x1, 'vlan1\x00'}, {0x14, 0x1, 'geneve1\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x278}, 0x1, 0x0, 0x0, 0x14}, 0x40084) (async) move_mount(r2, &(0x7f0000000440)='./file0\x00', r2, &(0x7f0000000480)='./file0\x00', 0x310) (async) sendmsg$NFNL_MSG_ACCT_GET(r2, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, 0x1, 0x7, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x6}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0xfffffffffffffffd}]}, 0x2c}}, 0x4000040) getpeername$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000640)=0x14) sendmsg$nl_route(r2, &(0x7f0000000700)={&(0x7f00000005c0), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)=@ipv4_getnexthop={0x24, 0x6a, 0x200, 0x1, 0x25dfdbfb, {}, [@NHA_GROUPS={0x4}, @NHA_OIF={0x8, 0x5, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x0) (async) ioctl$VIDIOC_S_AUDOUT(r2, 0x40345632, &(0x7f0000000740)={0x7fff, "06c48de151bb480c46b4f7d3ad068c33b9e5b68b365b16ac3c589675e09627e9", 0x3}) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000780)) r4 = socket$caif_seqpacket(0x25, 0x5, 0x1) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000007c0)=""/51, &(0x7f0000000800)=0x33) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x810c9365, &(0x7f0000000840)={{0xff, 0x3}, 0x100, './file0\x00'}) (async, rerun: 64) ioctl$VIDIOC_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f0000000980)={0x0, @bt={0x7fffffff, 0x7ff, 0x1, 0x1, 0xfffffffffffffff6, 0xffffffff, 0x7, 0x9, 0x6, 0xe, 0x80000000, 0x9, 0x8dbf, 0xa, 0x6, 0x17, {0x40, 0x3}, 0x5, 0x1}}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r2, 0xc01064c1, &(0x7f0000000a40)={0x0, 0x0, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000a80)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async) syz_open_dev$amidi(&(0x7f0000000ac0), 0x7f, 0x34480) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, &(0x7f0000000b00), 0xa0581, 0x0) (async, rerun: 32) io_uring_enter(r2, 0x243, 0xf793, 0x38, &(0x7f0000000b40)={[0xfffffffffffffffd]}, 0x8) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) (rerun: 32) ioctl$VIDIOC_S_DV_TIMINGS(r6, 0xc0845657, &(0x7f0000000bc0)={0x0, @bt={0x3215, 0x9, 0x0, 0x2, 0x1, 0x4, 0x200, 0x9, 0x8, 0x4, 0x7, 0x4, 0x9, 0x4, 0xc, 0x10, {0x1, 0xffffffff}, 0x5, 0xa}}) (async) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000c80), 0x8000, 0x0) (async, rerun: 64) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d00), r6) (rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r7, &(0x7f0000000e80)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000e40)={&(0x7f0000000d80)={0x9c, r8, 0x10, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0xf7, 0x6}, {0x6, 0x7}, {0x1, 0x7}, {0x1b, 0x4}, {0x90, 0x6}, {0x4}, {0x4, 0x2}, {0x15, 0x7}, {0x1, 0x2}, {0x81, 0x1}, {0xe, 0x5}, {0xff, 0x6}, {0xa, 0x4}, {0xa, 0x4}, {0x3, 0x6}, {0x4, 0x7}, {0xef, 0x4}, {0x4, 0x1}, {0x1, 0x4}, {0x7, 0x6}], "46c6db44cc21f50e"}}, @NL80211_ATTR_QOS_MAP={0x20, 0xc7, {[{0x5, 0x1}, {0x1, 0x7}, {0x9, 0x1}, {0x4, 0x4}, {0x6}, {0x2, 0x4}, {0x4, 0x6}, {0x4, 0x4}, {0x20, 0x6}, {0x5, 0x1}], "93bd8583ae3e64ad"}}, @NL80211_ATTR_QOS_MAP={0x2a, 0xc7, {[{0x4d, 0x5}, {0x5, 0x4}, {0x82, 0x3}, {0x7, 0x5}, {}, {0x9, 0x6}, {0x5, 0x7}, {0x2, 0x5}, {0xed, 0x5}, {0x9, 0x4}, {0x2}, {0xd9, 0x4}, {0x7, 0x1}, {0x3, 0x3}, {0x9, 0x1}], "73ca2fd946e5e5ba"}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x80001}, 0x4040040) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r6, 0x330f, 0x9) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x5, 0x810, r2, 0x7bea4000) (async, rerun: 32) syz_open_dev$loop(&(0x7f0000000ec0), 0x7fff, 0x100) (async, rerun: 32) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000f00)={0x8, 0x8a7, 0xfff7, 0x2, 0xb, "94983e7ffc3a2cbf"}) 8.288683613s ago: executing program 2 (id=567): clock_getres(0x8, &(0x7f0000000fc0)) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x8) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x800, 0x2, 0x0, 0xd, 0x0, 0x0, 0x0, 0x10, 0x5}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) fadvise64(r2, 0x8, 0x40, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r3, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000240)=@ethtool_sfeatures}) 8.209954287s ago: executing program 4 (id=568): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRESHEX=r3], 0x7c}, 0x1, 0x0, 0x0, 0x20000004}, 0x40000) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001cde20000000000000000000000000a58000000060a0b0400000000000000000200fffe2c00058028000180070001feffffffffffffff800800014000000002080002400000001105000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000500806d430787d5fb2dbb232bc551ba76ba9a"], 0x80}, 0x1, 0x0, 0x0, 0x840}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000009c0)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key(&(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000040)=""/3, &(0x7f0000000100)=0x3) keyctl$KEYCTL_WATCH_KEY(0x20, r5, 0xffffffffffffffff, 0x100000002) r6 = socket$alg(0x26, 0x5, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r4, 0x80984120, &(0x7f0000000340)) bind$alg(r6, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-224-generic\x00'}, 0x58) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[], 0x1b8}, 0x1, 0x0, 0x0, 0x40880}, 0x20008800) fcntl$dupfd(0xffffffffffffffff, 0x406, r6) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x90142, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 8.001103532s ago: executing program 0 (id=570): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1038, 0x12b6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x3) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022074c098b068a8997795b20ed9aaeee89f34e0538ef7325b751bf21e07f8abbe2db717a37d03208c6b3d701adf7cae13d9e9e67eb6a85b6b67c96cb1c0450795473eaddabafb0ea40eb7185f02b9f5bb23810f28eccaeb834b88a5983d6c63270f885f5550aa5b6dd64095a1ce5a43ee73f805e0400ab727e47ba05ddc1fd928bcd49c54a95c782f0d22fa2d412bbb319b78231d1a8aeee6e080b1715644de61217b50eb590fa43a32a3a85015cfabdcf4dc7569d1dde98d647f19813f08352d8b095c8a5e0c4e2e7ed25e197eb778c144bbd16433bf464c67330595008f0d08868fb84f26ae128eb"], 0x0}, 0x0) 7.481124542s ago: executing program 3 (id=571): socket$nl_netfilter(0x10, 0x3, 0xc) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) set_mempolicy_home_node(&(0x7f0000634000/0x4000)=nil, 0x4000, 0x3, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x111}}, 0x20) syz_mount_image$fuse(&(0x7f0000000100), 0x0, 0x80405, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000b64000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, &(0x7f0000000140)) r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x3, 0x10002) ioctl$EVIOCGRAB(r3, 0x40044590, &(0x7f0000000180)=0x1) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) getpid() setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000340)={'erspan0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x8, 0x7800, 0xd720, 0x1, {{0x7, 0x4, 0x1, 0x0, 0x1c, 0x64, 0x0, 0x6, 0x29, 0x0, @multicast2, @loopback, {[@rr={0x7, 0x7, 0x8d, [@remote]}]}}}}}) io_setup(0x4, &(0x7f00000003c0)) close(0x3) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000000)={0xfffffffc, 0x6, 0x20000000, 0x7ff, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r4, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) 6.464732766s ago: executing program 1 (id=572): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000080)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x924924924924c31, 0x3ec0) readv(r0, &(0x7f00000005c0)=[{&(0x7f00000000c0)=""/175, 0xaf}], 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x4, 0x4, 0x5, 0x2000003}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @loopback}, 0x2, 0x4}}, 0x26) (async) ioctl$PPPIOCGL2TPSTATS(r4, 0x8004745a, &(0x7f0000005280)) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) (async) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) setsockopt$sock_timeval(r5, 0x1, 0x15, &(0x7f0000000040)={0x0, 0x2710}, 0x10) (async) accept4$unix(r5, 0x0, 0x0, 0x800) 6.014026771s ago: executing program 0 (id=573): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_io_uring_setup(0x6440, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x40, 0x0, 0x3, 0x1, 0x0, 0xce}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB='.'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x11, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x55, 0x2000, @fd_index=0xd, 0x7, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0xf5ff) 5.906738726s ago: executing program 3 (id=574): mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r1, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r1, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1}) 5.776506784s ago: executing program 3 (id=575): socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, 0x0, &(0x7f0000000200)) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f000000ac40)=[{{&(0x7f00000002c0)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000340)=""/180, 0xb4}, {&(0x7f0000000400)=""/90, 0x5a}, {&(0x7f0000000480)=""/114, 0x72}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x4, &(0x7f0000001ac0)=""/4096, 0x1000}, 0x8000}, {{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000001500)=""/232, 0xe8}, {&(0x7f0000001600)=""/231, 0xe7}, {&(0x7f0000001700)=""/107, 0x6b}, {&(0x7f0000001780)=""/175, 0xaf}, {&(0x7f0000001840)=""/176, 0xb0}], 0x5, &(0x7f0000001980)=""/74, 0x4a}, 0x3ff}, {{0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f0000003ac0)=""/177, 0xb1}, {&(0x7f0000001a00)=""/84, 0x54}, {&(0x7f0000003b80)=""/229, 0xe5}, {&(0x7f0000003c80)=""/128, 0x80}, {&(0x7f0000003d00)=""/204, 0xcc}], 0x6, &(0x7f0000003e80)=""/4096, 0x1000}}, {{&(0x7f0000004e80)=@can, 0x80, &(0x7f00000001c0)=[{&(0x7f00000087c0)=""/208, 0xd0}], 0x1, &(0x7f0000004f00)=""/155, 0x9b}, 0xfffffff6}, {{0x0, 0x0, &(0x7f0000005040)=[{&(0x7f0000004fc0)=""/91, 0x5b}], 0x1}, 0xfffffffd}, {{&(0x7f0000005080)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000008340)=[{&(0x7f0000005100)=""/4096, 0x1000}, {&(0x7f0000006100)=""/96, 0x60}, {&(0x7f0000006180)=""/245, 0xf5}, {&(0x7f0000006280)=""/4096, 0x1000}, {&(0x7f0000007280)=""/4096, 0x1000}, {&(0x7f0000008280)=""/189, 0xbd}], 0x6}, 0x5}, {{&(0x7f00000083c0)=@in6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f00000086c0)=[{&(0x7f0000008440)=""/82, 0x52}, {&(0x7f00000084c0)=""/71, 0x47}, {&(0x7f0000008540)=""/55, 0x37}, {&(0x7f0000008580)=""/172, 0xac}, {&(0x7f0000008640)=""/110, 0x6e}], 0x5, &(0x7f0000008740)=""/78, 0x4e}, 0x9}, {{0x0, 0x0, &(0x7f000000ab00)=[{&(0x7f000000ae40)=""/4096, 0x1000}, {&(0x7f00000097c0)=""/238, 0xee}, {&(0x7f00000098c0)=""/198, 0xc6}, {&(0x7f00000099c0)=""/219, 0xdb}, {&(0x7f0000009ac0)=""/4096, 0x1000}, {&(0x7f000000aac0)=""/24, 0x18}], 0x6, &(0x7f000000ab80)=""/186, 0xba}}], 0x8, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x1}}, 0x20) r4 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7aa, 0x0) r7 = syz_open_dev$media(&(0x7f0000001a80), 0xa7e, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r7, 0xc0487c04, &(0x7f0000019640)={0x0, 0x0, 0x0, &(0x7f000001a000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000000)) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r5, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r5, 0x100000000000f7) keyctl$revoke(0x3, r4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x7101}) 5.776200942s ago: executing program 0 (id=576): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904", @ANYRES32], 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) fsopen(&(0x7f0000000300)='btrfs\x00', 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) chroot(0x0) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000340)={0x20, 0x17, 0xffffffffffffffe4, "0d0a00000000000000fe997ed7c0f4707b1755817cb65cc30a232f0321dfe3185b1985d24ef92a51508c6b828c50b4f1a5aee9ea2a8b432ce42cea31296640f020159c5017167c3b01de975349e76ad5e67802f63a3e4d9626253404d2f4a591245ec78e4397252c3f0e584d3b94cdc47c98237eafda82fd85b833a28a973c4128ccf4a60442052fabc48ab9534cde50b5682bb70397e5a8f646ca73b4aaf43bdf05cfee734d51de1d430b01cba9ef94decc030d1060404c2eb844306125ceb931d235b42332d0e77c280202ac6986b539acba408b12aab5d6f3038eeb6a3f31bd24d73f7e820d152ab09d4847f1a28861f76d4ab9ee58dd877d41d900d01b"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x6, 0x2, "4dec"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.502217851s ago: executing program 1 (id=577): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 32) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) unshare(0x22020400) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffbf}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r3, 0x0, 0xffffffffffffffff}, 0x18) (async, rerun: 64) r4 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') (rerun: 64) pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) (async) r5 = syz_open_procfs(r0, &(0x7f0000000180)='attr/current\x00') (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) read$char_usb(r5, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r6, 0x10000000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/net', 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async, rerun: 32) openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) (async, rerun: 32) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x0, 0x0) (async) epoll_create1(0x0) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x801, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) (async, rerun: 32) sendmsg$inet6(r7, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e23, 0x80000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="110000000000000029000000"], 0x18}, 0x40c0) (async, rerun: 32) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) 5.045956174s ago: executing program 2 (id=578): capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x9, 0xfff, 0xfffffff2, 0xffffffff, 0x2, 0x5f}) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$vbi(0x0, 0x0, 0x2) socket$kcm(0x10, 0x2, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) 4.884587547s ago: executing program 4 (id=579): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4d40) (async) syz_open_dev$usbfs(&(0x7f00000002c0), 0x76, 0x101b01) pipe2(&(0x7f00000000c0), 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000480)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x800, 0xb49, 0x0, 0x8, 0x0, 0x3}, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200080, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb0300050000"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) (async) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) socket$key(0xf, 0x3, 0x2) r5 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="fe"]) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) (async) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) (async) ioctl$KVM_GET_CPUID2(r7, 0xc008ae91, &(0x7f0000000000)) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0xbe) 4.858601322s ago: executing program 2 (id=580): socket(0x200000000000011, 0x2, 0xd) r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000a93000/0x4000)=nil, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) pipe2$watch_queue(0x0, 0x80) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x80800, 0x0) r4 = dup(r3) io_setup(0x19, &(0x7f00000009c0)) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r4, 0x5761, &(0x7f0000000100)=ANY=[]) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$apparmor_current(r6, &(0x7f0000000100)=@profile={'stack ', '#\x00'}, 0x8) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b63d25a80648c2594f90124fc60100c064001000009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000000) socket$netlink(0x10, 0x3, 0x12) write$FUSE_STATX(0xffffffffffffffff, &(0x7f0000000540)={0x130, 0x0, 0x0, {0x3, 0x6, 0x0, '\x00', {0x2000, 0x5, 0x7, 0xc07, 0x0, 0x0, 0xc000, '\x00', 0x1, 0x3ff, 0x0, 0x3, {0x0, 0x1}, {0x4, 0x800}, {0x961, 0x6a5ad1fb}, {0xfffffffffffffffe}, 0x80000000, 0xdc, 0x7e, 0xa}}}, 0x130) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\b\x00', @ANYRES16=0x0, @ANYBLOB="050000000000000000002e00000008000300", @ANYBLOB="0a003400020202020202"], 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=ANY=[], 0x2e) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socket$inet6(0xa, 0x3, 0x6) 4.754476082s ago: executing program 3 (id=581): r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0x895, &(0x7f0000000140)={0x0, 0x8c36, 0x80, 0xfffffffe, 0xbfdffddc}, &(0x7f00000001c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SYMLINKAT={0x26, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0x1, 0x1) socket$tipc(0x1e, 0x5, 0x0) sendmsg$nl_route(r4, 0x0, 0x40010) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0xa2442, 0x0) r5 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)={0x0, 0x101}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="14e7ffff0f00010000000000000000000000000a14000000020a0108000000000000000000000806140000001100010000000000010000000700000a"], 0x3c}, 0x1, 0x0, 0x0, 0x2000c005}, 0x20000000) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r5, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) gettid() 4.308350659s ago: executing program 0 (id=582): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue0\x00', 0x300000}) syz_usb_connect(0x2, 0x46, &(0x7f0000000640)=ANY=[@ANYBLOB="120150020d483520f0fff0ff111e01020301090234000106f7000609041e0007a00409050801100006fdff0905050200020d0401000000000000000086a7c42c58d1d40326acae68816f54c34f7234e6426ec562bf976b645c35185abbf557fb978ccae75d3f50390e18331da168b92e7d6f83a50cb1d38ccc8d23672075eb2a6a8341f740a0f427cc8a1afa663a863f9c4703be618297274d000000000000000000008189de571e5e8ec55809f28fb7fc3fcd5c855bf03df8278284e6b1d69bae749385cf9d33dc1a4f48ec4e13b2c5e106066cd5934cf655339000fb524aa900"/237], &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x0, 0x7}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000140)={0x3, 0xffff, 0x46, 0x0, 0xe}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x7, &(0x7f0000000600)) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x200) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f00000003c0)={0x2, 0x0, @ioapic={0xe89b1ba254ccdb64, 0xb5, 0xa9c1, 0xeffffdff, 0x0, [{0x0, 0x80}, {0x9, 0x5, 0x0, '\x00', 0x10}, {0xfc, 0x4}, {0xfe, 0x90, 0x3, '\x00', 0xff}, {0x8, 0x2, 0x5, '\x00', 0x9}, {0x0, 0x60}, {0x0, 0x85, 0xbe}, {0x0, 0x6, 0x2, '\x00', 0xb9}, {0x0, 0xff, 0x0, '\x00', 0xff}, {0xc, 0x4, 0xfe, '\x00', 0x42}, {0x0, 0x2}, {0x4, 0x50, 0xb}, {0x2, 0x0, 0x31, '\x00', 0x3}, {0x1, 0x4d}, {0x2, 0x2, 0x4, '\x00', 0xfe}, {0x0, 0x3}, {0x1, 0x0, 0x4, '\x00', 0x4}, {0x0, 0x0, 0x0, '\x00', 0xdd}, {0x1, 0x3, 0x7, '\x00', 0x6}, {0x80, 0x0, 0xe, '\x00', 0x7}, {0x5, 0xe5}, {0x0, 0x40, 0x0, '\x00', 0x70}, {0x1, 0x0, 0xfe, '\x00', 0xe}, {0x10, 0x83, 0xe, '\x00', 0xf4}]}}) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newlink={0x44, 0x10, 0x449, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0x9}, @IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x44}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000002080)={0xf, {"a2e3ad21e08eeb661b5d300987f70e06d038e7ff7fc6e5539b0d650e8b089b3f313b6c090890e0878f0e1ac6e7049b3b46959b649a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07410936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f6435f7590000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0da42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) ioctl$SNDCTL_SEQ_CTRLRATE(r7, 0xc0045103, &(0x7f0000000100)=0x6) openat$cgroup_netprio_ifpriomap(r7, &(0x7f0000000040), 0x2, 0x0) getsockopt$inet6_mreq(r7, 0x29, 0x15, &(0x7f0000000080), &(0x7f00000000c0)=0x14) mprotect(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x500000f) 4.189004203s ago: executing program 1 (id=583): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x7374, 0x0, 0xffffffff, 0xffdfffff}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r1, 0x0, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0, 0x44004}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x80, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x60, 0x0, 0x0, 0x0, {0x0, 0xc}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x8, 0x7, 0x3, 0x80000000}}, @TCA_CBS_PARMS={0x18, 0x1, {0x6, '\x00', 0x3, 0x1, 0x5, 0x4}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x4, 0x5, 0x6, 0xe8e}}]}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x1e9}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000805}, 0x0) io_uring_enter(r2, 0x47f4, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x3c, 0x18, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x60, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0xac, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5c, 0x6, "972261ede7193fe89a4728d4fa3a0b348e0b5845f83bfad29b0fce63e0651227f097b4bcbbd53941fc6882a0f82fb9b996e390fde0a88f88a5f5f7f62c30752088dfe249e17a3707d60d6b45bcdbc2645c2ad0074a8fe4f1"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELSET={0x24, 0xb, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELSET={0x15b8, 0xb, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xc}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x3c}, @NFTA_SET_EXPR={0x1594, 0x11, 0x0, 0x1, @bitwise={{0xc}, @val={0x1584, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x5c, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x57, 0x1, "cd923dde364c6018a3ea09915ad80967366ec00066dac8b77901a6b4d17d3f83378740074b0c4f6ad19d741bbf8f12b5996458e3c9f403d54c2b813b0928b9a02ace36bb6f96c8ae66b88fad93d0f0ff6ada51"}]}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_BITWISE_MASK={0x1ec, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x7}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x95, 0x1, "d041ea1e0ba71ff95477c307a5bed9af050a7016d5fc4cadd8e94089ee3c1a26cb16cced8ef5c54b2aea56a47e13cc8f2ac5c2df160382ee3687c480cee122908cd4e305b91704aa46afd794dc2e356d89a98d7526190f985054036985e28da189fad17dae39e9e09e5a901c8f136db13494d26de865688c5886a5cbed7c9a64412bd7a89f75348cf6f3a14f711aab5a10"}, @NFTA_DATA_VALUE={0xf9, 0x1, "f1048152e4ad3790f6c98846c728e1c9a559cb87bfad8d99f2cf607ff2936b9bf062e6a87f613fdd0462c29fdb182594379222c1f5fa6c7a86c52202452302dbc5e7bbe62a75d67b140ffd9e9394ec652a5aea8a515793a1ae0138aac075f48b19e93ea0521e085cfe21368c1782ee212e850f820b74c6536f68ddac2fdbe76984567e47cb5135a3ca6d20923a30d9788803bbb21289cf911d67ad1e105d9091597b9862f2675c2862f8036ba74369c9086fc3bdcfb5d78d2f8b67d72e6cda98487b9ac522922935f6946f851d29e143ba01febe09ff12967f681975a1bd0b4110a0dc4bd661486bd01301e3f7cc5e1ebc5aeac383"}]}, @NFTA_BITWISE_MASK={0x1328, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x83, 0x1, "9bc364b4a2b54be362d312c283b3aa8f79298cc2592fba86fac866fc6186b7f47e3ebe246a88a1906f3ffbe2bbfcbb253c1b301d63eff8078c6a1b514c6fe81693a16c73130e855c618722302392ca11f10c17edd53c1b3a92e981166f096bc5fe04a8a79b02f1db4077392f1d32f2748fa7f523466e060055351de445ebc7"}, @NFTA_DATA_VALUE={0x1004, 0x1, "4612f12e49d80774ff6c3f19123bfbe24d93a992999dd4198c3342cb5e9857717af6d46144872ae2e2bce3ed69cfd6c3beddd86af7195828535266f8a9315608ec1c695d707586e2d58bd3ecbf3fa16be16cd83b0004865a19768e1ba44287ad45193862953407049783576cfbf780c9ea2dd79695d5e0f9fa4e4d55441e6a916524cb6987eb31ee800722c54a9af991d0ebb96d0b6087e99cc342e0ce2cf5473cbc5b10f499e4ab9a709893d8cfdbb37ef653c5031169ca2165487dc2c0fb0ae0895d49b842c3f0c2a3750c8743bbe52eb9df6c7d55045d7288bb16725efb9b0dcd12031a30483e51d3101eca8b6754289ce3aba1f62cc289cde3d675507485854b0a6217d5f9fc6a80ff7a4350811d41c098b6514c1d2b77da3127d5f86570b9c9a8b99038316806f25d9cb5e8e9af051ba4d69aef489fd76ed5cc2b0a22f4cc1bdbf9a18431db177581ec072b3ccbcf408cd23b1ca461ca3e0f296b070af3a08536465c923eb73392ff92d75754117dd7369f0fb344649529dcd2045de9e826128fd099007c2463c357bc1801ee1f69f25356d05e1a9dc8184f9d5f10bd8cba06e24ddc907eb1cae07e44df8c36f459d23bc32a6a3ba2b6dc80396f24a53dfce9c666c7e60935294021a2688544fd45bd3c6575edabc668413e38713ce57131111cb37e40d9b7070201e4a234b82a5593c7da6a1791cff645524fddeef6f0f6b90b22a683b2297eae09fe0692b4647d8dd8757e692268e58113a1e7b76390a29e2220d9816fb0f588cc3d3ec2cda28cf35b913aa6a83ad4cbf062445d84eca0e05c1c10c90c7a924bfd7dc14f5091fbcc71111785c91ca3ff960f792a0083dec16ed6aa4291a4cd0a58216467ea57874917d0e431accbea755d5d2a2ec8ce0751397b2739962621781645a2da21a8c5fe7c87eaf229d077cabc00ed6f0adb3cd34fc4cb5641ef299c050fdc017c9ff89342e35162ea982759fb228667397b0e9134d1f8316ed2250e487b30f0ee906bd37f5c3ca7e00384769566c1d316a9221026c451a6dc2bcd8a0789d36bcdb65dea7f28140629757b4ae2cf11987bf4e7b0a4bc734fc32c3f8ed82b1eb8a274e74a7f0f340f4ed38ec72ccbbf029d95eddbd790b7415ae40c5a8e9be4a29c924a820ba075dddfe238b09f3e9b3a5dda6f9ff776c283e5f90ee4eabbeeacb1ac89848bfe123d8c9548752172ce36d5d6dd062f89e71181349ca27ad95ffb4742447678c022c86d097ffe312d1ac9d8a4202f02a7081599b2bd4812134614deceeaac28d36a70d86d94f645424fc4cfedc3a1f81d0b1bcd4045f8b7c32c2a3bda1bc9a58ae170b70b2e39c57117e7f41c242fd99e7590191e2a27ebd279da78b653443144843d9603fc02e04cd919d814a2fba4185db9cc44c7db33ae67b0f37f9c7566f7226b44a5441d27679a90f887bc3f375bb992b8f356f98fc25c478dd5c72374ce26aff17a08c0c7484fc4f69e5dadb146f53d457713b06a955003ffe2522a404c7e6207c2264b92ffd7ca14cda466358ae04f94e7e5399542735465b36e3779628e5352db3f6033c7a9e49da86694a73281c5660b4451742705829a5264b57badf2097967b5b0446190c38beae166975141927862914b3c70efe76b64987cc13c4eb0506e7eaeab5770ca017faf47c8399c77eb6bb8917406929f55cab934b210a2d5387040db0730ed2cae199b8a9f50cd72148516865b29d8013f7b663c00bdcf225c04948784150142a97f088cc0597d1a63b77c12478227fac19d131e828e0a8689430f83dc201d728b2f52eb3a324e645b6d41492c04681630f01aff2289bea42ae04c521b152995c39b67fcf46cff95821788513bf7383e546172dc0aedeed641c9eea9162b6867ac21f379ef92f25a8ed54c2dd4656ba48071b7238e499109c40f31c809a7daef484d6312f3edb15180926a188b51804b5884f2e5a3db41cf98f4d2711d332aa317882e3b4533ef4cee86c1434c28042d55d66cec070c2e2074b013318ad8ab4dc1db048ff383bf33aa5e526869990322778a033a45db76290c33e0da04423d677632d0e8bd99212409d513bbb5672c356ff290134ac2183a7b938447b375f3b0a660aa68e308d269d4194da69bcb2ae010932c315f2bca5688f8aec1549746f6e7850b3c8eaad8c7cf3bc647084b584ca7f9f7761ba3066f89a606ba43ec5c335520f49d981ad8c25407382595f0a14c17e0994079a995987e19689e14111052f65c16f567a6bb1a08a521577edc5be64997597011fe37ffd2f274946ff6632c3db1ef7f47dc49fd1b08c08a65ef68c51071d8e01a9ca2cb89523160db1577eab532a32b99198647aca43c066e3629866ab36e87c396f60f14d1544323f319fbf93ca177e75bc30759eaa973fe2c100030127df181d7120feabe8630137ea1cadd1eab6dc6a0dc34518455010ac5d8badae74c96b0a39b8bbf86571c462ab71f505927658c54909d0ddfc0b8a35c5f153edc6ba531b922d753c8f9fd0b952b5fc0daf46afca2b5c1408a22c8e7379cc1a1b9f11cdf64e24908ab43f63435f972e8319947448eb88b8610023093452bd7999120b16dba76dd56dc8b4e26d79a2155a3a0f2bd940d4d149160ebc50ed2ae6615dfa500ed30fe298b814275f0688b3935d18cbf7659a4401b1f79fc852754463cd3793dec07294a6d24d6b3fbb2032c0c6644e0af1eb954da8d2999196ad85c923c911a6f5a503655ba686fd5e34b79e3a2017a1e24cc5b42a5b9aec8738ab21dcbeb08f120d33921f3504eed755e6442066aa3d357a479024ad8b15ed626bdc3c286ae9639d107c2a1882baddd60e8152d7f85fd91214d03d2802173808d8b3d603493adc941b13f699863f11e3b19ced0ee656564812abb3292012d0db563fb20cfe126afe8a21a8f64054eadce918a778b3d046eb75cc361aa226aa4ec02fc7b5b607f094c0fcec3772444ec8c8202742984d78f902bfd78567807e82e4d8603ccbc141c06fbd5e6f832bcf657ed72516e4fd8b5003aefd38a8ece3d0f8531acec30c5e5e34b47d6636559b87c743ada6b9316ae5c308292b9c75447cae4c54cdfee76489dd2bd79a23aaa6c60357388a338d58962f558ad3845cabc2de2d354b4ffb11df6bed0d715b012f4b13ca29c13c851ef3cdcfaab5940b6b285cf3d232107459fe0f7ab6325ee28498c5861ef5ba035dee67643c910bf55334714579df1157c0ca6f2a147f6733a6e7aca2db4489056b5232b5ab267c574f24e4d97c051c578744e40b0ec4511a3f8ebd40e68e670be5a006df71c992add0887b6de20282ed88f2d3eb4e0a7d5da89f445296108b0f11c172bd08667d383592a69eea8a6e3a7afe25824fa83eca366a90942f1006e72d55c901d9ecd2fce7e9811df8e31d23121beab7ee608bf884025401e79f07ae8516cf34d7769a99031520d95ec48260af40439bcd0b99161769d6e85b80a73fcc35d2e33a83fb10d58d2751418889169d4b3ee779a2229ad56f562b460132a59565e11de49d49ad7663bee0f1cdaffcf7b39a900d15f54f3badf91358103d125fff3bb84d4fc3e5801a51f95f209cbfa85143b30ac38e5a3a0ad2ab658180f394868e9985bf5bee7c521979619bc39b12aee441fab00553ad35691540163241d1ded508a899da4e7c9b5ae9695177daa8f62c20f804847073ef09de35ea525c0f9dd311034011b55681531a65df4b57a32cd569568ea59f2be73f939dd0e0b4728d99e8ab7fcb1f959caa42912d2271d5a77772082a31bdd9c0f22896acb3540e97d810c28097264744222bc7ad96f8435613ab7c49cad951db45482bf711fb59a1f01b11348c07a8fc3237151751e8f02be33142bdafba7654544c782676047690fa2c10229f067bcdb270ea090d9103ca1a5e841ae2d5354db75c87baff1ae2bacbc3cba98b49cbd9fa4de1570791ac2d2b034260fa6aab83618a7392bdf545c7b6ce969f103a1d083807f6b58ca2d300738c0ad0c08b29901c433a9e20e28ed06e9f078ebb708bfa393b47608a9c3fe1498b4b077c6ed7421169df2354c5b9005a58b1f409d7a4e52483bd573223167ec7e7806a83c8acf3343e6eeed4b6a9d5e2809fc2d5f4b400c0ab98aa3868095688a8acfc89fa9e42dd90c108290821dc76f93baac81236453ee42b199a4c56d273161b4fee4fc59ba6b83c42bcb8b9c6031c11f981f07bf86a2fc29a218cf98f344fc3500ec272399061572bfe7f4ec93dcd1e15ba8793f7625d3f954988105158d89c9c1b1308dfdfaa0fe1b792a7c2fef1d52ea3f5fa561716211a2bae5b264688cf64cfa2a392b245ce8896c3d77f0055973d71cff7d2e4b302fcb94b3084bf3070b939e59973237e09396b1208b41e5819447e36eed8711e00da9b189629706ba50cddf72e751d815b7472ea8b7b9986db0efcfc79293b709a7bd30d270cc3652c404e33e287909a053e4ad6a995184da6ec49001ac66c95da2279e7559e27ed40a526832a2d1610c1dafc0a36ee6f3132873b0685f93c36e238d2d1fe4e0d6efdc01b3c01402364ce8d7599ea29f386663d0534c128a60c9787aa5fd59f3f69aab788ade7bb9bf7f0a34e941a8367efcf9e6f945f2c7c218e799dd416c63b35e75fc38458961008f9e2e9482ff8722b5923c262673afb9747a6da0ae8cb7e6b4b9007f5c13f9e430d330585505b4167bd5b7c68aee5d9d75d107196ffbab0431346f7f8145c1f6cd978f12fdc3ab0df530fbfa5b35bf41d8716ca6edc2302a2730c29b384a63508c90fe57dd351ed4c15304699c118b2fee863161f17a67eebf7d579a87fdab3af03487128c4eddb5a044c7a6b4c1a8f875f91e12dd72d21131e676772902709a723fb1508c7c42d3f7c0c25a27d53686d715c672beb7079aa48bee61248a7531b5a470e9bd258a6cf62f797c01135c3d0cc00a08c18a21173e0e9f5a237f55714fb7c4e4435c82fcf2c80ac3cbeb85724a2291b57faa33c14dc59890de72cbd4d29b771bfb09dbf76d0bf7209d9978a4b22843f302aa31e9d6b377387fe0de327e9f45f93c0ebd78054cd9073fe2b5f60dd2ecfff0484ab14b7cc1deea23f4720f35b8fb0503d87ce68cdce9bff86a95ef22301118135034d7b6e22c87582f5f3ff4ea97231db24d7c1170214099bbc5612f4ae40a429eaaca0d4d2ea2c735e81777f36ed9e280c16297995617b648dc6abbc83b1ad841e4c133e3203ee7f9898b0baa3e9d1f5753a679c9e565b01451a81cf13bb22382fd23c49f344179ae4c3d1f436f2a7850744a935ab5f3b7417ed972d4435a8a5bdc30fa13b8a47b1dfd91f16d75a2120ffb85039ea0068a49b3147756393e25db560645303d659d4d9290f9e33423659d47e9c17501f072363af85fc897ffdbe0cbd36fbeb8359fcfc48d8982e296a1e2974ca607c34a0a41a8aaf84543532f0457237ed7b883f9a2340142bc2da827c646aa317607d0b2e50c59a913fa6769b736f2e2c4227221f8f9331db7b3119f3506c713dd089f3712a4daad949823da0466077c91cc343a7deb9992879fe9bf581a8081d4d71cff64abba1f90636a84e7b1f5d1171b9bd9ac1674facec6fec5e53615bc2e3e56fd28d2faf7b19801cd497e846914012fc801a1e1a773cf71d0f84450272e3b45cda89dd26f8035e9926710f2a22de1b39ff232b360856192373ffc20f7a1c87a4d7392f6af034be7742441e1fc7ac8a37724bbf3c5c7e2b580f9d217c89f58139c2325a7566ca2ec2a0041d2d722998c65a3ec"}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x96, 0x1, "446cb7b920a6ec012a43a07b90606edd889fd62cf7202e41a3a3096bec5792f73cd7dce8140b43c2547a9c86b7a8d1c50e0343612442e90362bbeac5aa227711ba5d42890bba3e4b5ce87e6991431fa7d0a7e0520ab3e084d1afea308bbe859278e83370a3964260bffa117174e1721a96664201cd3ed2bad613066e9c38a50be6d94ef9bcedf7e9b697865d68c6e48fd5b5"}, @NFTA_DATA_VALUE={0x8f, 0x1, "559bea8e62d02b8b7d110f7bc2519d56d0037bb5c014c6de5a176a53c9a78bf84598fb7b5ced7c9b9f39d31c002f0318dfb074d6ff9da1eea06b3fc8cbbaabe1df78b8c8ccd8e4007a06387e1c97b6fde0d1c1e86144ebc6961a3c9f4bd52d8c1651cde47d5fb3aca30f196678d00f068f3be88f6ecdf20d34577cb33e24458d07b58c538f08b6a81bad7b"}, @NFTA_DATA_VALUE={0xab, 0x1, "41f19bfce53ac61ba27524d1d68145b2c7b0d67e177069c5e9e30e359400a238018baf5334a559a85c3fdad6b2c10295662a26148a8862fb00ab3876888a9807ca521f32cd7bb23a9fae7a1bd50c493171e01ecb1ef46d82001d79f3b002f52df70cffa2b9f0581d860e54c1cfcaff88edaa2a37165a7db2afb91a224222c1c08f19d627f457cb753c6929fb44267472d068276fdfa52948defe1b489abea7941f4512ef57bb42"}, @NFTA_DATA_VALUE={0xc1, 0x1, "5e426eddd846d1f64f39f06eb4be4d35cfad10a87a59a9744bb4714bfe7cce43c5f143ad7a5ebbd1c521b028824c91ed030e40b6440098dde4143eda4f15877072d780dcaf7b861ed03ef5a97bbd953a9f0d317fda484654d0995e9ca64d44fcdca97f436416435352dcb246a2b7f7a9f91ad1186b9db4e760f6264f31b90a827fc16dcadf6733ebc6eac65f156080c2b3ec4535e1bb8683671002d12da359a5c92e3c10363e76c4c4b78a1788c2855f9861c4cdf897c69ce30270c561"}]}]}}}]}, @NFT_MSG_NEWCHAIN={0xc0, 0x3, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_CHAIN_USERDATA={0xa4, 0xc, "03c6f471aac0a495ac86cfb3a9ad0dc03ea4e56f8442dd09e2f93c908bdfcb591b5595bb9a8ee14b9463a21ce85edcf729a614d9f53b410cb68624eea48a7a4f41c02449fb36dc29d5ffc9c581c7c1ce6b9996f5be633a7381af1f381a7c4bf41de649a73b31a1ed1479834e11f750458a885287f4b3ae18270c70a934714777401c7f86e947a6202b554aa0971ac3e5faf9bd7b412bc65b2f19e8f7efe5ed8d"}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWTABLE={0xb0, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}, [@NFTA_TABLE_USERDATA={0xfffffffffffffdc4, 0x6, "4fbba1d28970c33d2c83be7dff60e0aa12716f2dab3224b18be05aff3c599906a44a2874a377af3606a8ec54"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5f, 0x6, "737306f539e6ccd001b08d122d6bc5f6b9b92cd0cc794c589bcdbfc3c9f272105ec16f6223c9e2cc87d6574fa20efbfd4f7c3cad04d37b5c10838cc79a309a3bed80282a3c1fabc2292f02831f7257673338d4a8beadbc720380b3"}]}, @NFT_MSG_DELFLOWTABLE={0x4c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_FLAGS={0x8}]}], {0x14}}, 0x18e0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 3.631539123s ago: executing program 3 (id=584): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8800) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000200)=@name={0x1e, 0x2, 0x0, {{0x2, 0x2}, 0x200000}}, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1980, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230007) close(r4) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x404342, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x10, 0x1, 0x1, "a90037e7f30f000080df4809c305f70000000000004840080000000000008300", 0x37303250}) r6 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x100, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000240)=@IORING_OP_ACCEPT={0xd, 0x4, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r9}}) io_uring_enter(r6, 0x3516, 0x0, 0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') io_setup(0x8, 0x0) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r10, &(0x7f0000004ec0)=[{&(0x7f0000004bc0)=""/68, 0x44}], 0x1, 0x8000, 0x0) 2.440771413s ago: executing program 4 (id=585): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000040)={&(0x7f0000000340)={0x1d, r3}, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000d7fe68ca0000000000000000", @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) 2.33636287s ago: executing program 1 (id=586): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) (async) process_mrelease(0xffffffffffffffff, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 32) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (rerun: 32) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f00000000c0)={{}, {0x1, 0x5}, [], {}, [{0x8, 0x2, 0xee00}], {0x10, 0x6}, {0x20, 0x1}}, 0x8b, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x5836, 0x20000005, 0x7, 0x40, 0x1, 0x5479, 0x103b, 0x6, 0x0, 0x51, 0x1, 0x100000002, 0x1, 0x9, 0x5, 0x6a], 0x2000, 0x3c6a86}) (async, rerun: 32) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x20, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "9ac420002e2eafb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x1c, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.902993371s ago: executing program 2 (id=587): r0 = socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x1052c0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ppp={{0x8}, {0xc, 0x2, 0x0, 0x1, {0x8, 0x1, r4}}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xc}]}, 0x40}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0bfe6ecd77084f21c01e020000000900010073797a30000000000900020073797a320000000018000480140001800b0001006c6f6f6b75700000040002"], 0x74}}, 0x10) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r7, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r8, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r7, 0xc06864ce, &(0x7f0000000440)={r9, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c642d, &(0x7f0000000080)={r10, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r7, 0xc06864ce, &(0x7f0000000200)={r9, 0x0, 0x0, 0x0, 0x0, [0x0]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r13 = landlock_create_ruleset(&(0x7f0000000000)={0x0, 0x3}, 0x10, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r13, 0x2, &(0x7f0000000080)={0x3, 0x2b4}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r11, 0xc04064a0, &(0x7f00000004c0)={&(0x7f0000000100), &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xa, 0x2, 0x4}) ioctl$DRM_IOCTL_MODE_ATOMIC(r7, 0xc03864bc, &(0x7f0000000640)={0x1, 0x0, &(0x7f0000000500), &(0x7f0000000540)=[0x335, 0xffffff98, 0xd9d0, 0xfff, 0x8], &(0x7f0000000580), &(0x7f00000005c0), 0x0, 0x4a07}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r7, 0xc00c642d, &(0x7f0000000040)={r12}) close_range(r0, 0xffffffffffffffff, 0x0) 1.708632088s ago: executing program 1 (id=588): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, &(0x7f00000002c0)={0xc, r4}) ioctl$IOMMU_VFIO_SET_IOMMU(r3, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r3, 0x3b72, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000ff2f0000"]) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r5 = socket(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000200), 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r5, 0x84, 0x73, 0x0, &(0x7f0000000240)) sendmsg$netlink(r0, 0x0, 0xc000) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, &(0x7f0000000300)={0x0, {0x2, 0x4e20, @remote}, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x210, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)='veth0\x00', 0x1, 0x36, 0x400}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4a300, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = socket(0x1e, 0x1, 0x0) getsockopt$sock_buf(r9, 0x1, 0x1c, 0x0, 0x0) r10 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) 1.522703474s ago: executing program 0 (id=589): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setpriority(0x0, 0x1, 0xa7a8) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@remote, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "041800", 0x128, 0x3a, 0xff, @empty, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @mcast1, @dev={0xfe, 0x80, '\x00', 0xe}, [{0x4, 0x20, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) 1.053206962s ago: executing program 3 (id=590): ioctl$BLKGETNRZONES(0xffffffffffffffff, 0x80041285, &(0x7f0000000140)=0x8d7a) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100002f0c81087f180002ad6b37ed030109022400010000000009040000023c7f98000905ee000074000000090502"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) connect$unix(r1, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, &(0x7f0000000040)=0xabe) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7) ioctl$VHOST_VDPA_SET_CONFIG_CALL(0xffffffffffffffff, 0x4004af77, &(0x7f0000000340)=0x1aa8) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000202, 0x0, 0x0) munlockall() madvise(&(0x7f0000597000/0x1000)=nil, 0x1000, 0x13) mlock(&(0x7f0000ffa000/0x3000)=nil, 0x3000) r3 = open(0x0, 0x10040, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x42782, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000180)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="6c000000000101040000000000000000020000032400018014000180080001000000000008000200ac1414000c00028005000100000000001400068008000100ac1414bb08000100e000000108000740000000001800d76808000200ac1414430c000900000002004e220000"], 0x6c}, 0x1, 0x0, 0x0, 0x8440}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYRES8=r3], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x4008010) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000190}, 0x24044005) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[@ANYRES64=r0, @ANYRESDEC=r7, @ANYBLOB="4763ea5867fba2709c37c608000000000000bfc5c5a01d72eb7d5d7893bea7585c7c96a2dd597726c2ec2a09000000000000008b118ce5b9a1bd3f00430e66f0c20df9d7f68b4bb3f05525fc9b5d20983cc9bd52c5050cb7e82d07fe488aa3316224b74023530ac616bda40dd3e76d49de4e0c63f2956c5c05ffedf9166dbcb411706e23cbcbb0ce73952b568927853cc95043063f0bdce1ca0210f725db", @ANYRESOCT=r2, @ANYRES64=r9], 0x2c}, 0x1, 0x0, 0x0, 0x48001}, 0x0) 277.635441ms ago: executing program 4 (id=591): r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x12000) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000040)={0x3, 0x8, "84ef22a6179b3098"}) r1 = socket(0x400000000010, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000000)=['!\t\x00'], 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f00000007c0)={0x28, 0x7, r6, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000280)={0x28, 0x2, r6, 0x0, &(0x7f0000000200)="ea", 0x1, 0x8}) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000380)={0x28, 0x2, r6, r6, 0x1000ffe, 0x5, 0x9}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000000)={r4, 0x1, 0x6, @multicast}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000021c0)=@newtfilter={0xe84, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xe58, 0x2, [@TCA_FW_ACT={0xe54, 0x4, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa, 0x20}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x4, 0x1ff, 0x20000000, 0xc, 0x6}, 0x7f, 0x5}, [{0x2a9, 0x6, 0x810, 0x4, 0x5}, {0x4a7, 0x1ff, 0x4, 0x1, 0x7, 0xdd}, {0x9, 0x7, 0x3ff, 0x7, 0xfffffffd, 0x4}, {0x8, 0x0, 0x6, 0x2, 0x7fff, 0x3}, {0x4f9a, 0x5, 0x1, 0x1, 0x2, 0x8}, {0x0, 0x5, 0x1437, 0xffffffff, 0xee57, 0x9}, {0x77d, 0x8, 0x9, 0x6, 0x8, 0x1}, {0x5, 0x6, 0x0, 0x2, 0x1, 0x7fff}, {0x0, 0x5, 0x4235da1, 0x9, 0x7ec9, 0x8}, {0x10000, 0x2, 0x0, 0x1, 0x3, 0x9}, {0xd, 0xffff0001, 0x0, 0x6, 0x81, 0x4}, {0xfffffffc, 0x4, 0xffff, 0x8, 0xffffffff, 0xfffffffa}, {0x5, 0xd29, 0x101, 0x3, 0x7, 0xc}, {0x0, 0xfffffff7, 0x1, 0x72b2, 0xc874, 0x3}, {0x3, 0xf, 0x5, 0x1, 0x1ff, 0x6}, {0x9b9b, 0xffff, 0x6, 0xb, 0xb3d, 0x812}, {0x5, 0x7, 0x2, 0x5, 0x5, 0x4}, {0x6, 0x0, 0x9, 0x2, 0x7f, 0x2}, {0xfffffff7, 0x6, 0x2, 0x9, 0xff}, {0x4, 0x1, 0x371, 0x8, 0x0, 0xeac}, {0x9, 0x2, 0xd77, 0x8, 0x113, 0x8d3f}, {0x7, 0xffffffff, 0x4, 0x92a4, 0x9, 0x10}, {0x1a4a13f0, 0x9, 0xe, 0x3, 0xad47, 0xf83b}, {0x1ff, 0x5, 0x7, 0xfff, 0x9}, {0x100, 0x4, 0x200, 0x9, 0x1, 0x9df}, {0x9, 0x1, 0x65, 0x9, 0x7}, {0x401, 0x10001, 0x9, 0x200, 0x9, 0x1}, {0x6, 0x10, 0xf, 0x2, 0x6, 0x3}, {0xf23, 0x3ff, 0x0, 0x9, 0xffffffff}, {0x80000000, 0x6, 0x0, 0x6, 0x6, 0xd}, {0x0, 0x9, 0xd, 0x8000, 0x3, 0x2}, {0x800, 0x9, 0x6, 0x3, 0x7, 0x8}, {0x7, 0x8, 0x7358, 0x7, 0x8, 0xffffffff}, {0x4d9, 0x45db8bad, 0xb3dd, 0x1, 0xbc, 0x7ff}, {0x7, 0x1, 0x3, 0x3, 0x3, 0x7a}, {0x5a1b, 0x1, 0x1, 0x7ff, 0x3, 0x4}, {0x3, 0x7, 0x4, 0x4, 0x1c716ddc, 0x8}, {0xffffffa5, 0x7, 0x0, 0x10, 0x3, 0x5}, {0x8219, 0x0, 0x2, 0x6, 0x3, 0x2}, {0x62, 0xf4, 0x5, 0x4, 0x4, 0x67}, {0x5, 0x4, 0x53, 0x8, 0xc0000000, 0x7}, {0x2, 0x5, 0x2, 0xffff, 0x2, 0x2}, {0x80000001, 0x94c, 0x6, 0xfffffe00, 0x5, 0x7b27}, {0x2, 0x6, 0x1000, 0x9, 0x9}, {0xa, 0x0, 0x9, 0x4, 0xe, 0x9}, {0xdf, 0x7fff, 0x8000, 0x81, 0xff, 0xfffffff8}, {0x2, 0x10000, 0x9, 0x2, 0x2}, {0x2, 0x6, 0x9, 0x1, 0x2, 0x40}, {0xfffffe00, 0x3, 0x74d2, 0x3, 0x80000001, 0x6}, {0xe3f6, 0x8, 0xfffffff7, 0x1, 0x6, 0xa}, {0x8, 0x9, 0x8e, 0x33, 0x10001, 0x22cb}, {0x2, 0x31f5, 0x7, 0x5, 0x7fffffff, 0x1}, {0x9, 0x10001, 0x4, 0x8, 0x7, 0x9}, {0xb, 0x1ff, 0xb, 0x3, 0x5, 0x80000001}, {0x7, 0x7, 0x69b, 0x3, 0x8, 0x339}, {0xee, 0x80000000, 0xfba6, 0x101, 0x5, 0xb}, {0x3, 0x458, 0x6, 0xf, 0x7, 0x8000}, {0x9, 0xfffffffa, 0x1000, 0x8, 0xb, 0xce5a}, {0x3ff, 0xffff, 0x3, 0xbcbb, 0x7, 0xb}, {0x0, 0xe000, 0xb, 0x8, 0x2, 0x1}, {0x1, 0x0, 0x2, 0x9, 0x0, 0x401}, {0xd, 0x1, 0x2, 0xf, 0x81, 0x5}, {0x6, 0xfff, 0x3, 0x5, 0x4, 0x3649}, {0x7, 0x2, 0x80000000, 0x9, 0x1630, 0x9e73}, {0xb, 0x1b6, 0xc4, 0x3, 0x4, 0xca}, {0x4, 0x5, 0x401, 0x4, 0xfffffff8, 0x40}, {0x8, 0x4594, 0x8, 0x4, 0x0, 0xffff}, {0x100, 0xfffffffb, 0x6, 0x0, 0x9, 0x6}, {0x3, 0xf7b, 0x3, 0x8, 0x6, 0x3}, {0x1, 0x5, 0x3, 0xab9, 0x7, 0x9}, {0xffffffff, 0x0, 0xfc, 0x7, 0x6, 0x10}, {0xf, 0x1, 0xa000000, 0x1, 0x101, 0x1f3}, {0x7ff, 0x9, 0xfffff001, 0x8001, 0x2, 0x2}, {0x4, 0x10001, 0x6, 0x1, 0x9, 0xfffffff8}, {0x3, 0x3, 0x7, 0x9, 0x10, 0x1}, {0x5, 0x100, 0xffffffff, 0x963, 0x2, 0xc}, {0x6, 0x50, 0x6, 0xa, 0x0, 0x3}, {0x649, 0x2, 0x80000001, 0x8, 0x0, 0x1}, {0x8, 0xfffffffc, 0x6, 0x80000001, 0x7fffffff, 0x3}, {0xa3, 0x81, 0x9fcb, 0x1, 0x8, 0x7fff}, {0x0, 0x2, 0x750c, 0x0, 0x1, 0xfffffffc}, {0x7ff, 0x7, 0x10000, 0x9, 0x4, 0x88}, {0x5, 0x10001, 0x7fff, 0x81, 0xfffffff4, 0x7}, {0x5, 0x80000001, 0x5, 0x4, 0x1ff}, {0x3, 0x0, 0x3ff, 0x7fffffff, 0x9, 0x7}, {0xdac, 0x0, 0x4, 0x80000001, 0x3, 0x8}, {0x7, 0xffffffff, 0x6, 0x8, 0x80000001, 0xa}, {0x2, 0x4, 0x4, 0x401, 0xe32}, {0x5, 0x7, 0x6, 0x8, 0x2, 0x2}, {0x10001, 0x5, 0x3, 0x4, 0x9, 0xfffffffa}, {0x2, 0x0, 0x3, 0x6, 0x800, 0x3}, {0x0, 0x0, 0x3, 0x8, 0x1, 0x3}, {0x3, 0x3, 0xffffffff, 0x3, 0x800, 0xde}, {0x5, 0x66, 0x41d0, 0x8001, 0x1, 0x3}, {0x6, 0x7, 0xfffffffc, 0x4, 0x3, 0x92c}, {0x4, 0xffff, 0x0, 0x101, 0x4, 0x1}, {0x9, 0xf667, 0x5, 0x3, 0x9, 0x4}, {0x1731, 0xa, 0x9960, 0x9, 0x1, 0x7}, {0xd, 0xfffffffa, 0x1, 0x3, 0x40, 0x2}, {0x1, 0x4, 0x80000000, 0x80000001, 0x2, 0x6}, {0x7, 0x2, 0xffffff3a, 0x4cf, 0x800, 0x6}, {0x8000, 0x6, 0x1, 0x0, 0x100, 0x80000000}, {0x3b, 0x5562334a, 0x2, 0x2, 0x6, 0x81}, {0x4, 0x96, 0x81, 0x0, 0x101, 0x7}, {0x4, 0xff, 0x9, 0x0, 0x81, 0x29}, {0xa, 0x5, 0x0, 0x9, 0xffffffff, 0xfb4}, {0x80000001, 0x2, 0xffff, 0x39b4, 0x1, 0x800}, {0x61, 0x2d, 0x6, 0x1fe4c5d2, 0x1, 0x3}, {0x1, 0xe2, 0x7ff, 0x7ff, 0x7f, 0x29d0}, {0x0, 0x4, 0xc, 0xd594, 0x9, 0x7}, {0x6, 0x0, 0x7, 0x9, 0x7, 0x9}, {0x80e9, 0x7, 0x9, 0x1, 0x1, 0x18000}, {0x400, 0x9, 0x0, 0x6f}, {0x2, 0x1, 0x6, 0x3, 0xfffff71b, 0xce}, {0x1, 0xff, 0xb, 0x4, 0x800, 0x1}, {0x6, 0x2, 0x8, 0xfff, 0x4, 0x7fff}, {0x0, 0x0, 0x7f, 0x401, 0x7, 0x7fff}, {0x7, 0xb, 0x10000, 0x1, 0x8000, 0xfffff830}, {0x3, 0x4, 0x2, 0x1, 0x6, 0x2b4}, {0x3cd2dbce, 0x929a, 0x9dc, 0x0, 0x8, 0xfffffffc}, {0x6, 0x0, 0xe61, 0xc5c3, 0x3, 0x1}, {0x7, 0x2, 0x197a, 0x7, 0x1, 0x8}, {0xff, 0x2c, 0xfffffc01, 0x1, 0x3, 0x100}, {0x0, 0x6, 0x10001, 0xce7, 0xec, 0x1000}, {0xffffffff, 0x6, 0xffffffff, 0x9, 0x2, 0x6}, {0xfa, 0x9, 0xbf1d, 0x9, 0x80, 0x5}, {0x1c91, 0x5f27, 0x1, 0x0, 0x6, 0xcf}, {0x37, 0x622, 0x2, 0x1, 0x7, 0x2}], [{0x5}, {0xccffbfc290ab3baa}, {}, {0x2}, {0x2}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {}, {0x1, 0x1}, {0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x1}, {0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x2, 0x1}, {0x2}, {0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x4}, {0x3}, {0x3}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x5, 0x1}, {0x3}, {0x2}, {0x4}, {0x5}, {0x5, 0x1}, {0x2}, {0x1, 0x1}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {}, {0x3, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0xed3229170eca159, 0x1}, {0x2, 0x1}, {0x1}, {0x3}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x3}, {0x4}, {0x3, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x4}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x5}, {0x5}, {0x4, 0x1}, {0x4, 0x1}, {0x4}, {0x5}, {0x54e1b160e6ec45e8, 0x1}, {0x1, 0x1}, {0x2}, {0x3, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x4, 0x1}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x3}, {0x0, 0x1}, {0x5}, {}, {0x2}, {0x5, 0x1}, {0x4}, {0x2}, {0x9baeccaf277094c4, 0x1}, {}, {0x2, 0x1}, {}, {}, {0x8f9fc2e2ef57f2f0}, {0x3, 0x1}, {0x2, 0x1}, {0x2}, {0x3}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x1}, {0x1}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xe84}, 0x1, 0x0, 0x0, 0x81}, 0x800) 162.642531ms ago: executing program 2 (id=592): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000880)="22cff5", 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f00000000c0)={0x5, 0x0, 0x0, {0xffff, 0x3, 0xb0c, 0x8}}) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x50) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={r5, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xce024d}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000b50000008200000018110000", @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000001811", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) r7 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000000)=r6, 0x4) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r8, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e1f, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xf}, @multicast2}}}], 0x20}, 0x0) unshare(0x42000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$isdn(0x22, 0x3, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x10}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x7, 0x1, 0x9, 0x2, 0x4, 0x6}, {0x3, 0x2, 0xe, 0xb3b, 0x3, 0x6}, 0x9, 0x0, 0x2d}}, @TCA_TBF_PTAB={0x404, 0x3, [0xfb, 0x2, 0x101, 0x5, 0x2, 0xa28, 0x4, 0x9, 0xf, 0xffff6d77, 0xe4, 0x280, 0x107, 0x8001, 0x2, 0x0, 0x7, 0xff, 0x4, 0x401, 0x9, 0x5, 0x3, 0x1, 0xfffffff5, 0x5, 0xb8, 0x7, 0x5, 0x1, 0x157, 0x26553de0, 0x4, 0x7810, 0x80, 0x4, 0x1, 0x5, 0x1, 0x4, 0xf, 0x1000, 0x9, 0x6, 0xfff, 0x42, 0x44, 0x9, 0x6, 0x1, 0x7f, 0x9, 0x9, 0x6, 0x40, 0xffff, 0x0, 0x3, 0x9, 0x3, 0x7, 0xd61a, 0x1, 0x4, 0x8000, 0x5400000, 0x8000, 0x6, 0x400, 0x8000, 0x401, 0x4, 0xffffffff, 0x5, 0x8000, 0x1000, 0xb5, 0x6, 0x7, 0x0, 0x800, 0x1, 0x7fff, 0x401, 0x0, 0x2, 0x6e9, 0x8, 0x6, 0x5, 0xfffffffa, 0xffffff83, 0x7f, 0x9, 0x5feecc8, 0xb, 0x1a48dadd, 0xa3b, 0xfffffffa, 0x4, 0xffff, 0xc5, 0xbfa, 0x80000001, 0x8, 0x6, 0xacc, 0x7, 0x9, 0x1, 0x8001, 0x9, 0xcd4d, 0x5, 0x0, 0x7ff, 0x5, 0x5fd, 0x8, 0x8001, 0x9, 0xfffffff7, 0x76, 0x400, 0x4, 0x5, 0x9, 0x6, 0x17, 0x6, 0x2, 0x4, 0x400000, 0x10001, 0xd17, 0x1, 0x89, 0x4, 0x4, 0x8, 0x8, 0x10000, 0x9, 0x1, 0xce3, 0x4, 0x9, 0x96, 0x4, 0x6, 0x9, 0x8001, 0xc, 0x3, 0x2, 0x8969, 0x100, 0x100, 0x101, 0x7, 0x10000, 0x0, 0xc, 0x9, 0xfffffff1, 0x1, 0x1, 0x6, 0x7, 0x34a00, 0x45, 0x800800, 0x2, 0x2, 0x7, 0x3800, 0x8, 0x6, 0x4, 0xfffffffb, 0x4, 0xb, 0xc, 0x5, 0x2, 0x4, 0x2000000, 0x2, 0x2, 0x5, 0x5, 0xfffffff8, 0xda, 0x9, 0x8, 0x2, 0x1, 0x4, 0x8, 0x7, 0x36a3, 0x2, 0x5, 0xa1, 0x94, 0x4a9b, 0x9, 0x5, 0x0, 0x3, 0x3, 0x4, 0xe, 0xd, 0xfffffff2, 0x10001, 0x8, 0x0, 0x200, 0x7d, 0x2, 0x4, 0x1, 0x7fff, 0x3, 0x6, 0x3ff, 0x10000, 0x10, 0x0, 0x6, 0x8, 0x6, 0x8, 0x8, 0xf, 0x81, 0x4, 0x400, 0x3, 0xc, 0x8, 0x3, 0x6, 0x2c, 0x8, 0x25, 0x0, 0xb9, 0x3, 0x330c, 0xfffffffe, 0xc, 0x3a8b, 0x9, 0x1]}]}}]}, 0x45c}}, 0x0) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d9a", 0x380, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, '\x00'/12}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x2, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4610001394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "000000000000000200000000000000000000000000008879e66485201a0015ca837400000000000000000000001c000000000000000000"}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) 686.708µs ago: executing program 0 (id=593): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001e0001000000000000000000020000000100000000000000080001000000000008000f"], 0x2c}, 0x1, 0x0, 0x0, 0x2}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') read$FUSE(r1, &(0x7f0000000680)={0x2020}, 0x2020) (async) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000300)={0x1, 0x13, 0x3, 0x6, 0xd8, 0x3, &(0x7f0000000200)="0d35c841059fee57e44d01bf3a63e4eebd2963e59286043ea03a480bde9d72f2e82b294b4428b2c266de9003a5362bbc17a49dc137aa4d6a3749cc7a6a8cb19a50f65d221cab60c447a0126f72aef3e913fdc55c27b14768732b89cc959fb850a292dd908dcfaa032133826e1bf5eccf7f0a1dc8e6197d45c8c608f4cd8205ea0ca95aa35882eeae50310d0659f46ca912c217def23bda7c9f0038c2104088f672dc976bbf72938695dbe10dc97607b2f17fd3d0b036e9e1a20f9f8335ea5ef23f23b537da07a03c961a746be0cbd6b19a28512a5401855c"}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x9, 0x4, 0x2, 0x0, 0x9, 0xfffd, 0x7f]}}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x20000000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f0000000500)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00022dbd7000fbdbdf2555000000080001002600000008000300", @ANYRES32=r5, @ANYBLOB="ca8b576afe5714f41462f43536b55ca5586a72cab47c460e37ddc1cebd6aebf5af02d349b3fa8f8b2ea41942edd283206a2b4dc49f1364cff1b6f14f7e9fef3f36ef7b226f7ad658952efdc5b258af65d643521018c88b52dbab43f054650553dc33d9648f1fc61a4dfe2e46eb9182c6b6ba0231bfadb627a148721e87ece7122cfb98b61d15dcb5a9bd947d1f07735a5fb44d32993f71fbee320e956e849bb37535061055d569faa9701cdde3847b103093cfc5775a71f36e3c0d72176dcef0db592690f600000000000040ba9bb3a1983a66df4fd3cb999b4f2d6b736de5fc040783"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40040804) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r6 = open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) (async) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) userfaultfd(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(0x0, 0x101) bind$rxrpc(r6, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x9, @private1, 0x2}}, 0x24) r9 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r9, &(0x7f0000000000)={0x18, 0x0, {0x2, @multicast, 'tunl0\x00'}}, 0x1e) (async) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x18) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) 0s ago: executing program 4 (id=594): r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0x895, &(0x7f0000000140)={0x0, 0x8c36, 0x80, 0xfffffffe, 0xbfdffddc}, &(0x7f00000001c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SYMLINKAT={0x26, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0x1, 0x1) socket$tipc(0x1e, 0x5, 0x0) sendmsg$nl_route(r4, 0x0, 0x40010) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0xa2442, 0x0) r5 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)={0x0, 0x101}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="14e7ffff0f00010000000000000000000000000a14000000020a0108000000000000000000000806140000001100010000000000010000000700000a"], 0x3c}, 0x1, 0x0, 0x0, 0x2000c005}, 0x20000000) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r5, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) gettid() kernel console output (not intermixed with test programs): BOS descriptor or descriptor too short [ 131.953501][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 256, setting to 64 [ 131.969841][ T9] usb 1-1: New USB device found, idVendor=0123, idProduct=0001, bcdDevice=4a.fe [ 131.979763][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.987817][ T9] usb 1-1: Product: syz [ 131.993383][ T9] usb 1-1: Manufacturer: syz [ 131.998681][ T9] usb 1-1: SerialNumber: syz [ 132.007749][ T9] usb 1-1: config 0 descriptor?? [ 132.051358][ T979] usb 5-1: USB disconnect, device number 15 [ 132.216394][ T9] usbtouchscreen 1-1:0.0: probe with driver usbtouchscreen failed with error -71 [ 132.230217][ T9] usb 1-1: USB disconnect, device number 11 [ 132.811332][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.818908][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.890987][ T5997] usb 3-1: Firmware version (0.0) predates our first public release. [ 132.922557][ T5997] usb 3-1: Please update to version 0.2 or newer [ 133.019434][ T6740] netlink: 20 bytes leftover after parsing attributes in process `syz.0.200'. [ 133.308453][ T6744] netlink: 12 bytes leftover after parsing attributes in process `syz.0.203'. [ 133.371007][ T6744] 8021q: adding VLAN 0 to HW filter on device bond1 [ 133.386238][ T6748] bond_slave_0: entered promiscuous mode [ 133.392133][ T6748] bond_slave_1: entered promiscuous mode [ 133.398879][ T6748] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 133.409070][ T6748] bond1: (slave macvlan2): Enslaving as an active interface with an up link [ 134.074885][ T6764] misc userio: Can't change port type on an already running userio instance [ 134.195280][ T5997] usb 3-1: USB disconnect, device number 11 [ 134.690652][ T6773] pim6reg: entered allmulticast mode [ 135.399920][ T6775] netlink: 24 bytes leftover after parsing attributes in process `syz.1.211'. [ 135.942348][ T6768] pim6reg: left allmulticast mode [ 136.571145][ T6789] netlink: 12 bytes leftover after parsing attributes in process `syz.1.214'. [ 136.937910][ T6802] netlink: 28 bytes leftover after parsing attributes in process `syz.4.218'. [ 136.996709][ T6802] netlink: 28 bytes leftover after parsing attributes in process `syz.4.218'. [ 137.574944][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 137.736938][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.736969][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 137.737006][ T9] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 137.737027][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.739933][ T9] usb 1-1: config 0 descriptor?? [ 138.071841][ T6816] pim6reg: entered allmulticast mode [ 138.197854][ T9] hid_parser_main: 3 callbacks suppressed [ 138.197877][ T9] cm6533_jd 0003:0D8C:0022.0006: unknown main item tag 0x0 [ 138.197994][ T9] cm6533_jd 0003:0D8C:0022.0006: unknown main item tag 0x0 [ 138.202328][ T9] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0006/input/input11 [ 138.388979][ T9] cm6533_jd 0003:0D8C:0022.0006: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 138.571129][ T10] usb 1-1: USB disconnect, device number 12 [ 138.837493][ T6822] fido_id[6822]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 138.928553][ T6812] pim6reg: left allmulticast mode [ 139.072897][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 139.072914][ T30] audit: type=1326 audit(1758834775.739:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.072959][ T30] audit: type=1326 audit(1758834775.739:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=304 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.072996][ T30] audit: type=1326 audit(1758834775.739:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073033][ T30] audit: type=1326 audit(1758834775.739:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073070][ T30] audit: type=1326 audit(1758834775.739:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073117][ T30] audit: type=1326 audit(1758834775.739:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f51a698d97f code=0x7ffc0000 [ 139.073156][ T30] audit: type=1326 audit(1758834775.749:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073193][ T30] audit: type=1326 audit(1758834775.749:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073231][ T30] audit: type=1326 audit(1758834775.749:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.073269][ T30] audit: type=1326 audit(1758834775.749:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.4.224" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 139.394253][ T6832] pim6reg: entered allmulticast mode [ 139.468616][ C0] vkms_vblank_simulate: vblank timer overrun [ 139.550881][ C0] vkms_vblank_simulate: vblank timer overrun [ 139.670533][ C0] vkms_vblank_simulate: vblank timer overrun [ 139.735409][ C0] vkms_vblank_simulate: vblank timer overrun [ 139.737096][ T5933] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 139.985364][ T5933] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF6, changing to 0x86 [ 139.985397][ T5933] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 65535, setting to 1024 [ 139.985421][ T5933] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 139.985458][ T5933] usb 4-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 139.985480][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.989404][ T5933] usb 4-1: config 0 descriptor?? [ 139.996583][ T6835] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 140.000722][ T5933] gspca_main: spca561-2.14.0 probing abcd:cdee [ 140.066527][ C0] vkms_vblank_simulate: vblank timer overrun [ 140.234960][ T5933] spca561 4-1:0.0: probe with driver spca561 failed with error -22 [ 140.236039][ T5933] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 140.236111][ T5933] usb 4-1: MIDIStreaming interface descriptor not found [ 140.246491][ T6829] pim6reg: left allmulticast mode [ 140.390310][ T5933] usb 4-1: USB disconnect, device number 14 [ 140.868326][ T6841] kvm: user requested TSC rate below hardware speed [ 141.226234][ T6855] netlink: 'syz.0.230': attribute type 15 has an invalid length. [ 141.234160][ T6855] netlink: 24 bytes leftover after parsing attributes in process `syz.0.230'. [ 141.372020][ T6862] netlink: 'syz.4.231': attribute type 6 has an invalid length. [ 141.379972][ T6862] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.231'. [ 141.564276][ T6864] gretap1: entered promiscuous mode [ 141.614096][ T6869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.756567][ T979] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 141.924833][ T979] usb 3-1: Using ep0 maxpacket: 16 [ 141.933314][ T979] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 141.956635][ T979] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 142.008004][ T979] usb 3-1: too many endpoints for config 1 interface 1 altsetting 48: 49, using maximum allowed: 30 [ 142.037442][ T979] usb 3-1: config 1 interface 1 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 49 [ 142.185581][ T979] usb 3-1: config 1 interface 1 has no altsetting 0 [ 142.220565][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 142.254539][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.282624][ T979] usb 3-1: Product: syz [ 142.288455][ T979] usb 3-1: Manufacturer: syz [ 142.293062][ T979] usb 3-1: SerialNumber: syz [ 142.336988][ T979] usb 3-1: selecting invalid altsetting 1 [ 142.407885][ T979] usb 3-1: selecting invalid altsetting 0 [ 142.452098][ T979] usb 3-1: selecting invalid altsetting 0 [ 142.470288][ T979] cdc_ncm 3-1:1.0: bind() failure [ 142.542645][ T979] usb 3-1: selecting invalid altsetting 0 [ 142.577097][ T979] usbtest 3-1:1.1: probe with driver usbtest failed with error -22 [ 142.772318][ T979] usb 3-1: USB disconnect, device number 12 [ 144.250452][ T6897] fuse: Bad value for 'fd' [ 144.514948][ T5933] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 144.620009][ T6908] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 144.737689][ T5933] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 144.821987][ T5933] usb 4-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 144.886885][ T5933] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 145.054970][ T5933] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 145.064040][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.099952][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 145.099968][ T30] audit: type=1326 audit(1758834781.789:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.163644][ T30] audit: type=1326 audit(1758834781.789:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.359515][ T5933] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 145.468256][ T6924] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 145.495238][ T30] audit: type=1326 audit(1758834781.849:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.582747][ T5933] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 145.593071][ T30] audit: type=1326 audit(1758834781.849:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.626125][ T30] audit: type=1326 audit(1758834781.849:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.649810][ T30] audit: type=1326 audit(1758834781.849:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.719336][ T6924] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 145.724961][ T5933] usb 4-1: USB disconnect, device number 15 [ 145.758649][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 145.792197][ T30] audit: type=1326 audit(1758834781.919:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 145.907312][ T6933] netlink: 'syz.0.251': attribute type 6 has an invalid length. [ 145.915902][ T6933] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.251'. [ 145.991069][ T30] audit: type=1326 audit(1758834781.919:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 146.264792][ T6933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.377743][ T6939] pim6reg: entered allmulticast mode [ 146.635465][ T30] audit: type=1326 audit(1758834781.919:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 146.829496][ T30] audit: type=1326 audit(1758834781.919:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6915 comm="syz.0.248" exe="/root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 147.006754][ T6935] pim6reg: left allmulticast mode [ 147.828831][ T6943] openvswitch: netlink: Unknown key attributes 2 [ 148.191151][ T6957] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 148.314584][ T5933] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 148.594874][ T5933] usb 5-1: Using ep0 maxpacket: 32 [ 148.606053][ T5933] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 148.614151][ T5933] usb 5-1: config 0 has no interface number 0 [ 148.622511][ T5933] usb 5-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 148.674995][ T5933] usb 5-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 148.705683][ T5933] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 148.717101][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.736971][ T5933] usb 5-1: Product: syz [ 148.742540][ T5933] usb 5-1: Manufacturer: syz [ 148.754200][ T5933] usb 5-1: SerialNumber: syz [ 148.776368][ T5933] usb 5-1: config 0 descriptor?? [ 148.809669][ T5933] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 149.011290][ T5933] usb 5-1: qt2_setup_urbs - submit read urb failed -90 [ 149.020839][ T6972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.053270][ T5933] quatech2 5-1:0.51: probe with driver quatech2 failed with error -90 [ 149.094891][ T6972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.229829][ T43] usb 5-1: USB disconnect, device number 16 [ 149.262138][ T6980] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 149.355922][ T6980] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 150.016154][ T6984] pim6reg: entered allmulticast mode [ 150.930722][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 150.930737][ T30] audit: type=1326 audit(1758834787.619:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6998 comm="syz.2.269" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x0 [ 151.120312][ T6981] pim6reg: left allmulticast mode [ 151.125690][ T43] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 151.414006][ T43] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 151.514618][ T43] usb 1-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 151.637816][ T43] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 151.718151][ T7016] ALSA: mixer_oss: invalid OSS volume '' [ 151.744954][ T5933] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 151.798732][ T43] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 151.859005][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.945632][ T5933] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 151.966892][ T43] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 151.990206][ T5933] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 152.055586][ T5933] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 152.086907][ T5933] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 152.118373][ T43] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 152.144787][ T5933] usb 5-1: SerialNumber: syz [ 152.418687][ T5933] usb 5-1: 0:2 : does not exist [ 152.418827][ T43] usb 1-1: USB disconnect, device number 13 [ 152.488209][ T5933] usb 5-1: USB disconnect, device number 17 [ 152.680765][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 152.802668][ T7019] netlink: 'syz.2.274': attribute type 1 has an invalid length. [ 153.045187][ T5913] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 153.203435][ T7031] pim6reg9: entered allmulticast mode [ 153.218008][ T5913] usb 3-1: Using ep0 maxpacket: 8 [ 153.226434][ T5913] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 153.264984][ T5997] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 153.345662][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.387206][ T5913] usb 3-1: config 0 descriptor?? [ 153.404908][ T5959] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 153.504612][ T5997] usb 5-1: Using ep0 maxpacket: 16 [ 153.529718][ T5997] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 153.539214][ T5997] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.550817][ T5997] usb 5-1: Product: syz [ 153.554864][ T5959] usb 4-1: device descriptor read/64, error -71 [ 153.563477][ T5997] usb 5-1: Manufacturer: syz [ 153.568244][ T5997] usb 5-1: SerialNumber: syz [ 153.594087][ T5997] r8152-cfgselector 5-1: Unknown version 0x0000 [ 153.613722][ T5997] r8152-cfgselector 5-1: config 0 descriptor?? [ 153.835109][ T5959] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 153.964337][ T7043] pim6reg: entered allmulticast mode [ 154.126580][ T5959] usb 4-1: device descriptor read/64, error -71 [ 154.235166][ T5959] usb usb4-port1: attempt power cycle [ 154.364753][ T5997] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 154.544508][ T5997] usb 2-1: Using ep0 maxpacket: 8 [ 154.557745][ T5997] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 154.585077][ T5997] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 154.595006][ T5959] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 154.603052][ T5997] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 154.614049][ T5997] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 154.629858][ T5997] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 154.639198][ T5997] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.639460][ T5959] usb 4-1: device descriptor read/8, error -71 [ 154.707846][ T7039] pim6reg: left allmulticast mode [ 154.842839][ T7052] netlink: 'syz.0.285': attribute type 10 has an invalid length. [ 154.853022][ T7052] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.861870][ T7052] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.877196][ T5997] usb 2-1: GET_CAPABILITIES returned 0 [ 154.879237][ T7052] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.883466][ T5997] usbtmc 2-1:16.0: can't read capabilities [ 154.889878][ T7052] bridge0: port 2(bridge_slave_1) entered forwarding state [ 154.891135][ T7052] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.910256][ T7052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 154.918589][ T5959] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 154.939528][ T7052] bridge0: entered promiscuous mode [ 154.947569][ T5959] usb 4-1: device descriptor read/8, error -71 [ 154.948387][ T7052] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 154.983702][ T7051] netlink: 4 bytes leftover after parsing attributes in process `syz.0.285'. [ 154.992797][ T7051] bridge_slave_1: left allmulticast mode [ 154.998883][ T7051] bridge_slave_1: left promiscuous mode [ 155.006462][ T7051] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.017823][ T7051] bridge_slave_0: left allmulticast mode [ 155.023481][ T7051] bridge_slave_0: left promiscuous mode [ 155.029610][ T7051] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.053690][ T7051] bond0: (slave bridge0): Releasing backup interface [ 155.057372][ T5959] usb usb4-port1: unable to enumerate USB device [ 155.083529][ T7048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.093073][ T7048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.124376][ T5959] usb 2-1: USB disconnect, device number 13 [ 155.343119][ T5913] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 155.357496][ T5913] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 155.379081][ T5913] asix 3-1:0.0: probe with driver asix failed with error -71 [ 155.399890][ T5913] usb 3-1: USB disconnect, device number 13 [ 155.526237][ T7062] veth0_to_team: entered promiscuous mode [ 155.924849][ T5913] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 156.066300][ T5959] r8152-cfgselector 5-1: USB disconnect, device number 18 [ 156.294642][ T5997] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 156.475444][ T5913] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 156.595029][ T5959] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 156.692106][ T5913] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 156.701639][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.719894][ T5997] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 156.731834][ T5913] usb 3-1: Product: syz [ 156.741256][ T5997] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 156.774555][ T5959] usb 5-1: device descriptor read/64, error -71 [ 156.800245][ T5913] usb 3-1: Manufacturer: syz [ 156.812653][ T5913] usb 3-1: SerialNumber: syz [ 156.832243][ T5997] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 156.952615][ T5913] usb 3-1: config 0 descriptor?? [ 156.964143][ T5997] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.979489][ T5913] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 156.996271][ T5913] usb 3-1: setting power ON [ 157.010399][ T5913] dvb-usb: bulk message failed: -22 (2/0) [ 157.014581][ T5959] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 157.045324][ T5913] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 157.129184][ T5913] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) error while loading driver (-19) [ 157.175647][ T7082] netlink: 96 bytes leftover after parsing attributes in process `syz.2.294'. [ 157.184861][ T5913] dvb_usb_cxusb 3-1:0.0: probe with driver dvb_usb_cxusb failed with error -22 [ 157.221265][ T5913] usb 3-1: USB disconnect, device number 15 [ 157.268888][ T5997] usb 2-1: usb_control_msg returned -32 [ 157.289311][ T5959] usb 5-1: device descriptor read/64, error -71 [ 157.365115][ T9] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 157.383549][ T5997] usbtmc 2-1:16.0: can't read capabilities [ 157.418824][ T5959] usb usb5-port1: attempt power cycle [ 157.560376][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 157.586622][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 157.616411][ T9] usb 1-1: New USB device found, idVendor=06cb, idProduct=2968, bcdDevice= 0.00 [ 157.635882][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.659468][ T5997] usb 2-1: USB disconnect, device number 14 [ 157.698477][ T9] usb 1-1: config 0 descriptor?? [ 157.765990][ T5959] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 157.802035][ T5959] usb 5-1: device descriptor read/8, error -71 [ 157.977340][ T7099] loop2: detected capacity change from 0 to 7 [ 157.987860][ T7099] Dev loop2: unable to read RDB block 7 [ 157.993865][ T30] audit: type=1326 audit(1758834794.659:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.003776][ T7099] loop2: unable to read partition table [ 158.047781][ T5959] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 158.078920][ T7099] loop2: partition table beyond EOD, truncated [ 158.107156][ T5959] usb 5-1: device descriptor read/8, error -71 [ 158.116375][ T7099] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 158.174939][ T30] audit: type=1326 audit(1758834794.659:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.210161][ T7101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.221146][ T5959] usb usb5-port1: unable to enumerate USB device [ 158.257407][ T30] audit: type=1326 audit(1758834794.659:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.283870][ T7101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.341413][ T7103] netlink: 28 bytes leftover after parsing attributes in process `syz.0.299'. [ 158.351024][ T7103] netlink: 28 bytes leftover after parsing attributes in process `syz.0.299'. [ 158.421219][ T30] audit: type=1326 audit(1758834794.659:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.512972][ T30] audit: type=1326 audit(1758834794.669:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7efea318d710 code=0x7ffc0000 [ 158.660279][ T30] audit: type=1326 audit(1758834794.669:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.718022][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 158.753847][ T30] audit: type=1326 audit(1758834794.669:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.784946][ T30] audit: type=1326 audit(1758834794.669:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.809881][ T30] audit: type=1326 audit(1758834794.669:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.838914][ T30] audit: type=1326 audit(1758834794.669:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7098 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 158.885160][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 159.283715][ T10] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 159.293241][ T10] usb 3-1: config 179 has no interface number 0 [ 159.351895][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 159.381128][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 159.393965][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 159.422099][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 159.448088][ T10] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 159.464254][ T10] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 159.479201][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.546943][ T7106] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 159.558432][ T10] xpad 3-1:179.65: probe with driver xpad failed with error -5 [ 159.929216][ T7133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.972170][ T7133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.446938][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 160.463927][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 160.474652][ T5997] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 160.484083][ T9] usb 1-1: USB disconnect, device number 14 [ 160.625480][ T5997] usb 2-1: Using ep0 maxpacket: 16 [ 160.652126][ T5997] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 160.674825][ T5997] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 160.721711][ T5997] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 160.743148][ T5997] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 160.753038][ T5997] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 160.762216][ T5997] usb 2-1: config 0 has no interface number 0 [ 160.793640][ T5997] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 160.808150][ T5997] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 160.818528][ T5997] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 160.829829][ T5997] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 160.845652][ T5997] usb 2-1: config 0 interface 125 has no altsetting 0 [ 160.855307][ T7140] loop2: detected capacity change from 0 to 7 [ 160.872774][ T5967] Dev loop2: unable to read RDB block 7 [ 160.872861][ T5997] usb 2-1: config 0 interface 125 has no altsetting 2 [ 160.886014][ T5967] loop2: unable to read partition table [ 160.893995][ T5997] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 160.903705][ T5967] loop2: partition table beyond EOD, truncated [ 160.910023][ T5997] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.920573][ T5997] usb 2-1: Product: syz [ 160.924925][ T5997] usb 2-1: Manufacturer: syz [ 160.929763][ T5997] usb 2-1: SerialNumber: syz [ 161.039084][ T9] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 161.050513][ T7140] Dev loop2: unable to read RDB block 7 [ 161.056414][ T7140] loop2: unable to read partition table [ 161.062319][ T7140] loop2: partition table beyond EOD, truncated [ 161.068853][ T7140] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 161.087174][ T5997] usb 2-1: config 0 descriptor?? [ 161.140821][ T5997] usb 2-1: selecting invalid altsetting 2 [ 161.195754][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 161.223976][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 102, changing to 10 [ 161.239801][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 161.251640][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 161.268123][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 161.295204][ T9] usb 5-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 161.321759][ T9] usb 5-1: Product: syz [ 161.330009][ T9] usb 5-1: Manufacturer: syz [ 161.353946][ T9] usb 5-1: SerialNumber: syz [ 161.411244][ T7150] netlink: 'syz.3.314': attribute type 6 has an invalid length. [ 161.419134][ T7150] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.314'. [ 161.516570][ T9] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input12 [ 161.543663][ C1] usb 2-1: async_complete: urb error -71 [ 161.549460][ C1] usb 2-1: async_complete: urb error -71 [ 161.555183][ C1] usb 2-1: async_complete: urb error -71 [ 161.587954][ T5997] get_1284_register: usb error -71 [ 161.593676][ T5997] uss720 2-1:0.125: probe with driver uss720 failed with error -71 [ 161.794172][ T7150] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 161.881595][ T7138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.902810][ T7138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.919165][ T5997] usb 2-1: USB disconnect, device number 15 [ 162.291355][ T7154] ptrace attach of "./syz-executor exec"[5885] was attempted by "./syz-executor exec"[7154] [ 162.321890][ T5913] usb 3-1: USB disconnect, device number 16 [ 162.975183][ T5913] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 163.203506][ T7161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.316'. [ 163.226877][ T7166] binder: 7162:7166 ioctl c0306201 200000000080 returned -14 [ 163.380669][ T5913] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 163.391160][ T5913] usb 3-1: can't read configurations, error -61 [ 163.535499][ T5913] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 163.877400][ T5913] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 163.886892][ T5913] usb 3-1: can't read configurations, error -61 [ 163.893468][ T5913] usb usb3-port1: attempt power cycle [ 164.072620][ T43] usb 5-1: USB disconnect, device number 23 [ 164.138577][ T43] appletouch 5-1:1.0: input: appletouch disconnected [ 164.254568][ T5913] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 164.299147][ T5913] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 164.307055][ T5913] usb 3-1: can't read configurations, error -61 [ 164.452098][ T5913] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 164.721970][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 164.721989][ T30] audit: type=1326 audit(1758834801.399:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7171 comm="syz.1.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 164.747084][ T5913] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 164.786358][ T5913] usb 3-1: can't read configurations, error -61 [ 164.806899][ T5913] usb usb3-port1: unable to enumerate USB device [ 164.864623][ T30] audit: type=1326 audit(1758834801.399:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7171 comm="syz.1.319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 165.036021][ T5997] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 165.194558][ T5997] usb 4-1: device descriptor read/64, error -71 [ 165.774590][ T5997] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 165.790309][ T30] audit: type=1326 audit(1758834802.479:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 165.995047][ T5997] usb 4-1: device descriptor read/64, error -71 [ 166.032723][ T30] audit: type=1326 audit(1758834802.509:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.054933][ C1] vkms_vblank_simulate: vblank timer overrun [ 166.063958][ T30] audit: type=1326 audit(1758834802.509:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.091366][ T30] audit: type=1326 audit(1758834802.509:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.118689][ T30] audit: type=1326 audit(1758834802.509:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.140863][ C1] vkms_vblank_simulate: vblank timer overrun [ 166.151013][ T5997] usb usb4-port1: attempt power cycle [ 166.168799][ T30] audit: type=1326 audit(1758834802.509:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.190955][ C1] vkms_vblank_simulate: vblank timer overrun [ 166.204001][ T30] audit: type=1326 audit(1758834802.509:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.240858][ T30] audit: type=1326 audit(1758834802.509:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7184 comm="syz.2.322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea318eec9 code=0x7ffc0000 [ 166.504624][ T5997] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 166.528210][ T5997] usb 4-1: device descriptor read/8, error -71 [ 166.884559][ T5997] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 166.906941][ T5997] usb 4-1: device descriptor read/8, error -71 [ 167.028768][ T5997] usb usb4-port1: unable to enumerate USB device [ 167.289324][ T7202] xt_l2tp: missing protocol rule (udp|l2tpip) [ 169.887534][ T5940] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 169.916279][ T7238] qrtr: Invalid version 195 [ 170.089461][ T5940] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 170.144114][ T5940] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.255283][ T5940] usb 3-1: Product: syz [ 170.259473][ T5940] usb 3-1: Manufacturer: syz [ 170.274956][ T10] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 170.333531][ T5940] usb 3-1: SerialNumber: syz [ 170.367183][ T5940] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 170.393201][ T43] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 170.424988][ T10] usb 1-1: device descriptor read/64, error -71 [ 170.655339][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 170.655351][ T30] audit: type=1326 audit(1758834807.349:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 170.685177][ T10] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 170.787310][ T30] audit: type=1326 audit(1758834807.349:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 170.832903][ T5940] usb 3-1: USB disconnect, device number 21 [ 170.960783][ T10] usb 1-1: device descriptor read/64, error -71 [ 171.040737][ T30] audit: type=1326 audit(1758834807.379:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 171.124293][ T10] usb usb1-port1: attempt power cycle [ 171.264506][ T30] audit: type=1326 audit(1758834807.379:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 171.286696][ C1] vkms_vblank_simulate: vblank timer overrun [ 171.489181][ T43] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 171.505217][ T10] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 171.530047][ T43] ath9k_htc: Failed to initialize the device [ 171.564283][ T10] usb 1-1: device descriptor read/8, error -71 [ 171.579755][ T5940] usb 3-1: ath9k_htc: USB layer deinitialized [ 171.585989][ T30] audit: type=1326 audit(1758834807.379:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 171.742422][ T7265] netlink: 32 bytes leftover after parsing attributes in process `syz.4.344'. [ 171.838264][ T7265] tipc: Invalid UDP bearer configuration [ 171.838334][ T7265] tipc: Enabling of bearer rejected, failed to enable media [ 171.885105][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 171.902970][ T30] audit: type=1326 audit(1758834807.379:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 172.033787][ T10] usb 1-1: device descriptor read/8, error -71 [ 172.045074][ T30] audit: type=1326 audit(1758834807.379:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 172.208221][ T30] audit: type=1326 audit(1758834807.379:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 172.311652][ T10] usb usb1-port1: unable to enumerate USB device [ 172.354932][ T30] audit: type=1326 audit(1758834807.389:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa298b8d710 code=0x7ffc0000 [ 172.498199][ T30] audit: type=1326 audit(1758834807.389:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7253 comm="syz.3.341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 172.622423][ T7285] syzkaller1: entered promiscuous mode [ 172.628373][ T7285] syzkaller1: entered allmulticast mode [ 172.724527][ T5940] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 172.914589][ T5940] usb 5-1: Using ep0 maxpacket: 16 [ 172.942328][ T5940] usb 5-1: config 0 has an invalid interface number: 63 but max is 0 [ 172.978518][ T5940] usb 5-1: config 0 has no interface number 0 [ 172.995443][ T5940] usb 5-1: config 0 interface 63 altsetting 150 endpoint 0x81 has an invalid bInterval 204, changing to 11 [ 173.090801][ T5940] usb 5-1: config 0 interface 63 altsetting 150 endpoint 0x81 has invalid maxpacket 42588, setting to 1024 [ 173.106746][ T5940] usb 5-1: config 0 interface 63 altsetting 150 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 173.196708][ T5940] usb 5-1: config 0 interface 63 has no altsetting 0 [ 173.211552][ T5940] usb 5-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 173.364563][ T5997] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 173.373288][ T5940] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.421391][ T5940] usb 5-1: config 0 descriptor?? [ 173.451035][ T7283] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 173.552532][ T5997] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 173.622236][ T5997] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.680354][ T5997] usb 4-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 173.702288][ T5997] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.775085][ T5997] usb 4-1: config 0 descriptor?? [ 173.834897][ T9] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 173.887750][ T5940] usbhid 5-1:0.63: can't add hid device: -71 [ 173.902144][ T5940] usbhid 5-1:0.63: probe with driver usbhid failed with error -71 [ 173.952529][ T5940] usb 5-1: USB disconnect, device number 24 [ 174.055307][ T9] usb 1-1: config index 0 descriptor too short (expected 65069, got 45) [ 174.073857][ T9] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 174.151582][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 174.189041][ T9] usb 1-1: config 0 has no interfaces? [ 174.201603][ T5997] hid-alps 0003:044E:1215.0007: item fetching failed at offset 6/7 [ 174.204462][ T9] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 174.238952][ T5997] hid-alps 0003:044E:1215.0007: parse failed [ 174.263136][ T5997] hid-alps 0003:044E:1215.0007: probe with driver hid-alps failed with error -22 [ 174.271832][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.347028][ T9] usb 1-1: config 0 descriptor?? [ 174.401663][ T5997] usb 4-1: USB disconnect, device number 24 [ 174.588088][ T43] usb 1-1: USB disconnect, device number 19 [ 174.643089][ T7320] netlink: 'syz.1.363': attribute type 1 has an invalid length. [ 174.705653][ T7320] 8021q: adding VLAN 0 to HW filter on device bond2 [ 174.732972][ T7320] bond2: (slave geneve2): making interface the new active one [ 174.757767][ T7320] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 175.240284][ T7334] netlink: 132 bytes leftover after parsing attributes in process `syz.3.367'. [ 175.318991][ T7334] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 175.325543][ T7334] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 175.437267][ T7334] vhci_hcd vhci_hcd.0: Device attached [ 175.754538][ T9] vhci_hcd: vhci_device speed not set [ 175.836814][ T9] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 175.886079][ T7337] vhci_hcd: connection reset by peer [ 175.894161][ T1102] vhci_hcd: stop threads [ 175.902437][ T1102] vhci_hcd: release socket [ 175.908741][ T1102] vhci_hcd: disconnect device [ 176.282966][ T7355] netlink: 28 bytes leftover after parsing attributes in process `syz.4.371'. [ 176.336465][ T7357] fuse: Bad value for 'fd' [ 176.342276][ T7355] netlink: 44 bytes leftover after parsing attributes in process `syz.4.371'. [ 176.396684][ T7359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.555071][ T7359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.605014][ T10] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 176.824512][ T43] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 176.984687][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 176.991469][ T43] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 177.004938][ T43] usb 5-1: config 0 has no interface number 0 [ 177.202676][ T43] usb 5-1: config 0 interface 255 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 177.244467][ T7378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.256032][ T7378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.358167][ T43] usb 5-1: config 0 interface 255 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 177.376231][ T43] usb 5-1: New USB device found, idVendor=2001, idProduct=1a02, bcdDevice=bb.ee [ 177.386339][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.399711][ T43] usb 5-1: Product: syz [ 177.404777][ T43] usb 5-1: Manufacturer: syz [ 177.409510][ T43] usb 5-1: SerialNumber: syz [ 177.417395][ T43] usb 5-1: config 0 descriptor?? [ 177.424309][ T7363] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 177.626972][ T7363] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 178.562252][ T7403] (unnamed net_device) (uninitialized): up delay (6) is not a multiple of miimon (100), value rounded to 0 ms [ 178.575135][ T7403] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-tlb(5) [ 178.673205][ T7397] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 178.680477][ T7397] syzkaller1: linktype set to 774 [ 178.906516][ T43] asix 5-1:0.255 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 179.003306][ T43] asix 5-1:0.255: probe with driver asix failed with error -71 [ 179.088700][ T43] usb 5-1: USB disconnect, device number 25 [ 179.474643][ T43] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 179.555195][ T5959] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 179.634810][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 179.664609][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 179.671142][ T43] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 179.686755][ T43] usb 5-1: config 0 has no interfaces? [ 179.692384][ T43] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 179.705653][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.730792][ T43] usb 5-1: config 0 descriptor?? [ 179.796734][ T5959] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 179.809038][ T5959] usb 2-1: config 0 has no interfaces? [ 179.816872][ T5933] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 179.828704][ T5959] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 179.873448][ T5959] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.902488][ T5959] usb 2-1: config 0 descriptor?? [ 179.975414][ T5933] usb 4-1: Using ep0 maxpacket: 16 [ 179.994022][ T5933] usb 4-1: unable to get BOS descriptor or descriptor too short [ 180.003785][ T5933] usb 4-1: config 1 interface 0 has no altsetting 0 [ 180.022084][ T5933] usb 4-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 180.033106][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.042376][ T5933] usb 4-1: Product: syz [ 180.047474][ T5933] usb 4-1: Manufacturer: syz [ 180.119444][ T5933] usb 4-1: SerialNumber: syz [ 180.163958][ T7410] netlink: 16 bytes leftover after parsing attributes in process `syz.1.382'. [ 180.219880][ T7421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.230532][ T7421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.268802][ T7424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.278482][ T7424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.300799][ T7420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.310037][ T7420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.319595][ T7420] netlink: 144 bytes leftover after parsing attributes in process `syz.4.380'. [ 180.348260][ T7416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.370995][ T7416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.402804][ T5933] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input13 [ 180.449771][ T5222] bcm5974 4-1:1.0: could not read from device [ 180.463329][ T5997] usb 2-1: USB disconnect, device number 16 [ 180.470984][ T5933] bcm5974 4-1:1.0: could not read from device [ 180.520349][ T5222] bcm5974 4-1:1.0: could not read from device [ 180.546176][ T5933] input: failed to attach handler mousedev to device input13, error: -5 [ 180.605966][ T5222] bcm5974 4-1:1.0: could not read from device [ 180.676624][ T5222] bcm5974 4-1:1.0: could not read from device [ 180.758691][ T5933] usb 4-1: USB disconnect, device number 25 [ 180.900751][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 180.912286][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 180.961116][ T9] vhci_hcd: vhci_device speed not set [ 180.981875][ T10] usb 3-1: can't read configurations, error -71 [ 181.183401][ T7436] loop6: detected capacity change from 0 to 2560 [ 181.260049][ T7436] buffer_io_error: 27 callbacks suppressed [ 181.260067][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.310605][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.319206][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.339938][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.359648][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.368502][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.378837][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.387353][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 181.405195][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.419005][ T7436] ldm_validate_partition_table(): Disk read failed. [ 181.427461][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.437216][ T7436] Buffer I/O error on dev loop6, logical block 0, async page read [ 181.447803][ T7436] Dev loop6: unable to read RDB block 0 [ 181.460980][ T7436] loop6: unable to read partition table [ 181.477553][ T7436] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 181.546394][ T10] usb 3-1: too many configurations: 65, using maximum allowed: 8 [ 181.565123][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.619981][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.632326][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.645579][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.677799][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.805960][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.826735][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.839238][ T10] usb 3-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 181.868785][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 181.884245][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.903717][ T10] uvcvideo 3-1:250.0: probe with driver uvcvideo failed with error -22 [ 182.109368][ T10] usb 3-1: USB disconnect, device number 24 [ 182.561470][ T7465] fuse: Bad value for 'fd' [ 182.868862][ T43] usb 5-1: USB disconnect, device number 26 [ 183.397688][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 183.397705][ T30] audit: type=1326 audit(1758834820.089:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.426069][ C0] vkms_vblank_simulate: vblank timer overrun [ 183.459259][ T7490] loop2: detected capacity change from 0 to 7 [ 183.495232][ T5237] Dev loop2: unable to read RDB block 7 [ 183.518917][ T5237] loop2: unable to read partition table [ 183.520850][ T30] audit: type=1326 audit(1758834820.089:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.554995][ T5237] loop2: partition table beyond EOD, truncated [ 183.579611][ T7490] Dev loop2: unable to read RDB block 7 [ 183.588860][ T30] audit: type=1326 audit(1758834820.119:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.590787][ T7490] loop2: unable to read partition table [ 183.610939][ C0] vkms_vblank_simulate: vblank timer overrun [ 183.656959][ T7490] loop2: partition table beyond EOD, truncated [ 183.663327][ T30] audit: type=1326 audit(1758834820.119:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.666560][ T7490] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 183.715133][ T30] audit: type=1326 audit(1758834820.119:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.744937][ T30] audit: type=1326 audit(1758834820.119:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f51a698d710 code=0x7ffc0000 [ 183.767984][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 183.780402][ T5237] Dev loop2: unable to read RDB block 7 [ 183.786633][ T30] audit: type=1326 audit(1758834820.119:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.788423][ T5237] loop2: unable to read partition table [ 183.808840][ C0] vkms_vblank_simulate: vblank timer overrun [ 183.826630][ T30] audit: type=1326 audit(1758834820.149:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.864988][ T10] usb 2-1: new low-speed USB device number 17 using dummy_hcd [ 183.875764][ T30] audit: type=1326 audit(1758834820.149:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.876962][ T5237] loop2: partition table beyond EOD, truncated [ 183.919519][ T7502] syzkaller0: entered promiscuous mode [ 183.925496][ T7502] syzkaller0: entered allmulticast mode [ 183.952185][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 183.958030][ T30] audit: type=1326 audit(1758834820.149:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7488 comm="syz.4.399" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f51a698eec9 code=0x7ffc0000 [ 183.999702][ T9] usb 3-1: config 1 has an invalid interface number: 236 but max is 0 [ 184.021308][ T9] usb 3-1: config 1 has no interface number 0 [ 184.029932][ T9] usb 3-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 184.047577][ T10] usb 2-1: Invalid ep0 maxpacket: 64 [ 184.058346][ T9] usb 3-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 184.069364][ T9] usb 3-1: config 1 interface 236 has no altsetting 0 [ 184.092660][ T9] usb 3-1: config 1 has an invalid interface number: 236 but max is 0 [ 184.142430][ T9] usb 3-1: config 1 has no interface number 0 [ 184.178024][ T9] usb 3-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 184.189070][ T10] usb 2-1: new low-speed USB device number 18 using dummy_hcd [ 184.199667][ T9] usb 3-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 184.210393][ T9] usb 3-1: config 1 interface 236 has no altsetting 0 [ 184.221997][ T9] usb 3-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=aa.6a [ 184.242531][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.251068][ T9] usb 3-1: Product: syz [ 184.255719][ T9] usb 3-1: Manufacturer: syz [ 184.260343][ T9] usb 3-1: SerialNumber: syz [ 184.272275][ T9] ti_usb_3410_5052 3-1:1.236: TI USB 5052 2 port adapter converter detected [ 184.345181][ T10] usb 2-1: Invalid ep0 maxpacket: 64 [ 184.350922][ T10] usb usb2-port1: attempt power cycle [ 184.414681][ T5959] usb 5-1: new low-speed USB device number 27 using dummy_hcd [ 184.604814][ T5959] usb 5-1: device descriptor read/64, error -71 [ 184.732885][ T10] usb 2-1: new low-speed USB device number 19 using dummy_hcd [ 184.775100][ T10] usb 2-1: Invalid ep0 maxpacket: 64 [ 184.844957][ T5959] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 184.938147][ T10] usb 2-1: new low-speed USB device number 20 using dummy_hcd [ 184.980569][ T10] usb 2-1: Invalid ep0 maxpacket: 64 [ 185.008961][ T10] usb usb2-port1: unable to enumerate USB device [ 185.024462][ T5959] usb 5-1: device descriptor read/64, error -71 [ 185.135072][ T5959] usb usb5-port1: attempt power cycle [ 185.165140][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 185.183299][ T10] usb 3-1: USB disconnect, device number 25 [ 185.335549][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 185.384995][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 185.419387][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 185.499213][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 185.519282][ T5959] usb 5-1: new low-speed USB device number 29 using dummy_hcd [ 185.553510][ T9] usb 4-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 185.583412][ T9] usb 4-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 185.610639][ T5959] usb 5-1: device descriptor read/8, error -71 [ 185.617938][ T9] usb 4-1: Product: syz [ 185.622094][ T9] usb 4-1: Manufacturer: syz [ 185.642791][ T7523] netlink: 'syz.0.408': attribute type 6 has an invalid length. [ 185.651034][ T7523] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.408'. [ 185.681085][ T9] usb 4-1: SerialNumber: syz [ 185.717782][ T9] usb 4-1: config 0 descriptor?? [ 185.736253][ T9] smsusb:smsusb_probe: board id=2, interface number 0 [ 185.765334][ T9] smsusb:smsusb_probe: Device initialized with return code -19 [ 185.914872][ T5959] usb 5-1: new low-speed USB device number 30 using dummy_hcd [ 185.928692][ T7512] netlink: 8 bytes leftover after parsing attributes in process `syz.3.405'. [ 185.965420][ T5959] usb 5-1: device descriptor read/8, error -71 [ 186.076316][ T5959] usb usb5-port1: unable to enumerate USB device [ 186.111935][ T5997] usb 4-1: USB disconnect, device number 26 [ 186.220047][ T7530] netlink: 36 bytes leftover after parsing attributes in process `syz.3.409'. [ 186.415422][ T7532] netlink: 20 bytes leftover after parsing attributes in process `syz.2.410'. [ 186.614068][ T7534] fuse: Bad value for 'fd' [ 186.644612][ T5997] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 186.849625][ T5997] usb 4-1: device descriptor read/64, error -71 [ 186.974475][ T5959] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 187.104531][ T5997] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 187.172086][ T5959] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.192080][ T5959] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 187.245542][ T5997] usb 4-1: device descriptor read/64, error -71 [ 187.246179][ T5959] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 187.262822][ T7543] loop2: detected capacity change from 0 to 7 [ 187.275311][ T7543] Dev loop2: unable to read RDB block 7 [ 187.281001][ T7543] loop2: unable to read partition table [ 187.296395][ T5959] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.312826][ T7543] loop2: partition table beyond EOD, truncated [ 187.324719][ T7543] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 187.354164][ T5959] usb 2-1: config 0 descriptor?? [ 187.369493][ T5997] usb usb4-port1: attempt power cycle [ 187.714461][ T5997] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 187.745192][ T5997] usb 4-1: device descriptor read/8, error -71 [ 187.833585][ T5959] kovaplus 0003:1E7D:2D50.0008: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0 [ 187.984531][ T5997] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 187.992708][ T7556] openvswitch: netlink: IPv4 frag type 255 is out of range max 2 [ 188.025538][ T5997] usb 4-1: device descriptor read/8, error -71 [ 188.135086][ T5997] usb usb4-port1: unable to enumerate USB device [ 188.144678][ T7551] netlink: 4 bytes leftover after parsing attributes in process `syz.1.412'. [ 188.250528][ T5959] kovaplus 0003:1E7D:2D50.0008: couldn't init struct kovaplus_device [ 188.275046][ T5959] kovaplus 0003:1E7D:2D50.0008: couldn't install mouse [ 188.290068][ T7566] FAULT_INJECTION: forcing a failure. [ 188.290068][ T7566] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 188.297961][ T5959] kovaplus 0003:1E7D:2D50.0008: probe with driver kovaplus failed with error -32 [ 188.334451][ T7566] CPU: 1 UID: 0 PID: 7566 Comm: syz.2.421 Not tainted syzkaller #0 PREEMPT(full) [ 188.334478][ T7566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 188.334495][ T7566] Call Trace: [ 188.334502][ T7566] [ 188.334510][ T7566] dump_stack_lvl+0x189/0x250 [ 188.334537][ T7566] ? __pfx____ratelimit+0x10/0x10 [ 188.334556][ T7566] ? __pfx_dump_stack_lvl+0x10/0x10 [ 188.334575][ T7566] ? __pfx__printk+0x10/0x10 [ 188.334597][ T7566] ? __might_fault+0xb0/0x130 [ 188.334632][ T7566] should_fail_ex+0x414/0x560 [ 188.334660][ T7566] _copy_from_user+0x2d/0xb0 [ 188.334683][ T7566] ___sys_recvmsg+0x12e/0x510 [ 188.334710][ T7566] ? __pfx____sys_recvmsg+0x10/0x10 [ 188.334755][ T7566] ? __fget_files+0x3a0/0x420 [ 188.334782][ T7566] do_recvmmsg+0x307/0x770 [ 188.334812][ T7566] ? __pfx_do_recvmmsg+0x10/0x10 [ 188.334844][ T7566] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 188.334880][ T7566] __x64_sys_recvmmsg+0x190/0x240 [ 188.334901][ T7566] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 188.334917][ T7566] ? rcu_is_watching+0x15/0xb0 [ 188.334939][ T7566] ? do_syscall_64+0xbe/0x3b0 [ 188.334961][ T7566] do_syscall_64+0xfa/0x3b0 [ 188.334978][ T7566] ? lockdep_hardirqs_on+0x9c/0x150 [ 188.334995][ T7566] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.335012][ T7566] ? clear_bhb_loop+0x60/0xb0 [ 188.335032][ T7566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.335048][ T7566] RIP: 0033:0x7efea318eec9 [ 188.335069][ T7566] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 188.335084][ T7566] RSP: 002b:00007efea3fc4038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 188.335110][ T7566] RAX: ffffffffffffffda RBX: 00007efea33e5fa0 RCX: 00007efea318eec9 [ 188.335123][ T7566] RDX: 0000000000000001 RSI: 0000200000000740 RDI: 0000000000000003 [ 188.335134][ T7566] RBP: 00007efea3fc4090 R08: 0000000000000000 R09: 0000000000000000 [ 188.335145][ T7566] R10: 0000000040000040 R11: 0000000000000246 R12: 0000000000000001 [ 188.335167][ T7566] R13: 00007efea33e6038 R14: 00007efea33e5fa0 R15: 00007efea350fa28 [ 188.335195][ T7566] [ 188.608940][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 188.608956][ T30] audit: type=1326 audit(1758834825.299:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 188.835277][ T30] audit: type=1326 audit(1758834825.339:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 188.959849][ T30] audit: type=1326 audit(1758834825.339:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 188.982060][ C0] vkms_vblank_simulate: vblank timer overrun [ 188.991761][ T30] audit: type=1326 audit(1758834825.339:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb9f138d710 code=0x7ffc0000 [ 189.019351][ T30] audit: type=1326 audit(1758834825.339:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 189.045741][ T7581] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.425'. [ 189.058739][ T7581] netlink: 36 bytes leftover after parsing attributes in process `syz.2.425'. [ 189.069257][ T30] audit: type=1326 audit(1758834825.339:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb9f138d710 code=0x7ffc0000 [ 189.101890][ T30] audit: type=1326 audit(1758834825.339:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 189.211597][ T30] audit: type=1326 audit(1758834825.339:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 189.233740][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.379775][ T30] audit: type=1326 audit(1758834825.339:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 189.401964][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.468180][ T30] audit: type=1326 audit(1758834825.339:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.0.420" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb9f138eec9 code=0x7ffc0000 [ 189.520439][ T7590] netlink: 'syz.3.427': attribute type 6 has an invalid length. [ 189.528882][ T7590] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.427'. [ 189.683977][ T7594] tipc: Enabling of bearer rejected, failed to enable media [ 189.719735][ T7590] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 189.841653][ T10] usb 2-1: USB disconnect, device number 21 [ 189.928694][ T7597] netlink: 128 bytes leftover after parsing attributes in process `syz.1.431'. [ 190.374721][ T5913] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 190.554516][ T5913] usb 1-1: Using ep0 maxpacket: 8 [ 190.576730][ T5913] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 190.624399][ T7611] can: request_module (can-proto-3) failed. [ 190.632714][ T5913] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 190.702324][ T5913] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 190.787960][ T5913] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 190.858020][ T5913] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 190.882827][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.114680][ T43] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 191.179774][ T5913] usb 1-1: usb_control_msg returned -32 [ 191.189126][ T5913] usbtmc 1-1:16.0: can't read capabilities [ 191.335951][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 191.355662][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 191.376688][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 191.453839][ T43] usb 2-1: language id specifier not provided by device, defaulting to English [ 191.502975][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 191.562433][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.606186][ T43] usb 2-1: Product: ࠒ [ 191.618117][ T43] usb 2-1: Manufacturer: 木⇠䌆Ӧȧ囻髃육࣊ﯾ굉懪홍옞毽ꢛ츈⺶島輀⑄얉൚㈒仆ᡣ桡筆﬈௄ [ 191.650045][ T43] usb 2-1: SerialNumber: ꀄᑭꪸ缔꾛̇㫹詖ᢗ홟襑友ꃟ鉷䫃ു좯ሽޣߏ刐蠕㜮髭㖖ꂄ㧓횲趤侮໲ꖵ鞩マ㳏剷厤걯钤읠ᓿ鸹湔텡勡渱㭕먻犙ᅫ䖱磱꒍ [ 191.672141][ T7630] netlink: 44 bytes leftover after parsing attributes in process `syz.4.438'. [ 191.810260][ T7635] fuse: blksize only supported for fuseblk [ 191.845399][ T9] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 191.925574][ T7637] netlink: 28 bytes leftover after parsing attributes in process `syz.4.442'. [ 191.938556][ T7637] bridge_slave_0: default FDB implementation only supports local addresses [ 191.948173][ T7638] netlink: 28 bytes leftover after parsing attributes in process `syz.4.442'. [ 191.957922][ T7638] bridge_slave_0: default FDB implementation only supports local addresses [ 191.984981][ T9] usb 3-1: device descriptor read/64, error -71 [ 192.090041][ T7645] loop2: detected capacity change from 0 to 7 [ 192.131825][ T7645] Dev loop2: unable to read RDB block 7 [ 192.139167][ T7645] loop2: unable to read partition table [ 192.155998][ T7645] loop2: partition table beyond EOD, truncated [ 192.194579][ T7645] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 192.264602][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 192.425080][ T9] usb 3-1: device descriptor read/64, error -71 [ 192.625715][ T9] usb usb3-port1: attempt power cycle [ 192.643432][ T7652] IPVS: stopping backup sync thread 6025 ... [ 192.651723][ T7653] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 4, id = 0 [ 193.006103][ T5940] usb 1-1: USB disconnect, device number 20 [ 193.044730][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 193.068920][ T9] usb 3-1: device descriptor read/8, error -71 [ 193.734458][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 193.766208][ T43] cdc_ncm 2-1:1.0: bind() failure [ 193.810707][ T43] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 193.849320][ T43] cdc_ncm 2-1:1.1: bind() failure [ 193.863255][ T9] usb 3-1: device descriptor read/8, error -71 [ 193.891009][ T43] usb 2-1: USB disconnect, device number 22 [ 194.038584][ T9] usb usb3-port1: unable to enumerate USB device [ 194.210131][ T7673] netlink: 4 bytes leftover after parsing attributes in process `syz.0.448'. [ 194.256043][ T7673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 194.305534][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.311971][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.321570][ T43] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 194.496611][ T43] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 194.521051][ T43] usb 2-1: can't read configurations, error -61 [ 194.684674][ T43] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 195.260517][ T43] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 195.268460][ T43] usb 2-1: can't read configurations, error -61 [ 195.287387][ T43] usb usb2-port1: attempt power cycle [ 195.714527][ T43] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 195.759133][ T7695] ip6gre1: entered promiscuous mode [ 195.765243][ T7695] ip6gre1: entered allmulticast mode [ 195.777318][ T43] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 195.815574][ T43] usb 2-1: can't read configurations, error -61 [ 195.994796][ T43] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 196.038737][ T43] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 196.085813][ T10] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 196.090844][ T43] usb 2-1: can't read configurations, error -61 [ 196.116095][ T43] usb usb2-port1: unable to enumerate USB device [ 196.294807][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 196.340170][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 196.350640][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 196.380314][ T10] usb 3-1: New USB device found, idVendor=1189, idProduct=0893, bcdDevice=f4.95 [ 196.390836][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.412444][ T10] usb 3-1: Product: syz [ 196.429079][ T10] usb 3-1: Manufacturer: syz [ 196.443923][ T10] usb 3-1: SerialNumber: syz [ 196.518074][ T10] usb 3-1: config 0 descriptor?? [ 196.532291][ T7690] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 196.557854][ T7690] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 197.129680][ T7720] C: renamed from team_slave_0 (while UP) [ 197.262529][ T7720] netlink: 164 bytes leftover after parsing attributes in process `syz.3.458'. [ 197.364734][ T43] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 197.932788][ T43] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 197.950902][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.983364][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 198.019378][ T43] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 198.061318][ T7729] binder: 7725:7729 ioctl c0306201 200000000100 returned -11 [ 198.099500][ T10] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 198.122074][ T7730] fuse: Bad value for 'fd' [ 198.130581][ T43] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 198.144759][ T43] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 198.145595][ T10] asix 3-1:0.0: probe with driver asix failed with error -71 [ 198.152782][ T43] usb 2-1: Product: syz [ 198.152805][ T43] usb 2-1: Manufacturer: syz [ 198.303455][ T43] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 198.362369][ T10] usb 3-1: USB disconnect, device number 30 [ 198.374511][ T9] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 198.507357][ T7719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.537643][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 198.604938][ T7719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.605545][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 198.615873][ T43] usb 2-1: USB disconnect, device number 27 [ 198.685065][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 198.707676][ T9] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 198.725501][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.733710][ T9] usb 5-1: Product: syz [ 198.738419][ T9] usb 5-1: Manufacturer: syz [ 198.743089][ T9] usb 5-1: SerialNumber: syz [ 198.754222][ T9] usb 5-1: config 0 descriptor?? [ 198.762924][ T7733] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 198.770742][ T7733] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 198.781700][ T9] usb 5-1: ucan: probing device on interface #0 [ 198.981839][ T7739] bond0: (slave bond_slave_0): Releasing backup interface [ 199.001396][ T7739] bond_slave_0: left promiscuous mode [ 199.051565][ T7739] bond0: (slave bond_slave_1): Releasing backup interface [ 199.068330][ T7739] bond_slave_1: left promiscuous mode [ 199.084039][ T7739] team0: Port device team_slave_0 removed [ 199.170400][ T7739] team0: Port device team_slave_1 removed [ 199.253000][ T7739] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 199.322322][ T7739] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 199.357591][ T7739] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 199.392613][ T7747] netlink: 'syz.0.463': attribute type 10 has an invalid length. [ 199.457800][ T7739] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 199.545757][ T43] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 199.558616][ T7739] team0: Port device vxlan0 removed [ 199.567210][ T7739] bond1: (slave macvlan2): Releasing backup interface [ 199.792375][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.810905][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.822844][ T43] usb 4-1: New USB device found, idVendor=0dfc, idProduct=010a, bcdDevice= 0.00 [ 199.832330][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.847643][ T43] usb 4-1: config 0 descriptor?? [ 199.853137][ T9] ucan 5-1:0.0 can0: registered device [ 199.909436][ T7747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.943699][ T7747] team0: Device bond0 failed to register rx_handler [ 200.131238][ T3511] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.143501][ T3511] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.165289][ T3511] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.265133][ T7743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.272359][ T3511] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.318377][ T7743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.374831][ T43] hid-generic 0003:0DFC:010A.0009: hidraw0: USB HID v0.00 Device [HID 0dfc:010a] on usb-dummy_hcd.3-1/input0 [ 200.603962][ T7743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.640609][ T7743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.675569][ T43] usb 4-1: USB disconnect, device number 31 [ 200.710270][ T7758] fido_id[7758]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 201.045344][ T9] ucan 5-1:0.0 can0: firmware string: unknown [ 201.122769][ T7761] warning: `syz.4.468' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 201.145358][ T9] usb 5-1: USB disconnect, device number 31 [ 201.291859][ T7767] PKCS8: Unsupported PKCS#8 version [ 201.297162][ T7765] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 201.365959][ T7771] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 201.574744][ T5997] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 201.647427][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 201.647443][ T30] audit: type=1326 audit(1758834838.339:643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 201.747420][ T5997] usb 3-1: device descriptor read/64, error -71 [ 201.757104][ T30] audit: type=1326 audit(1758834838.339:644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 201.958064][ T7759] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 201.959096][ T30] audit: type=1326 audit(1758834838.339:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.001172][ T30] audit: type=1326 audit(1758834838.339:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.036417][ T30] audit: type=1326 audit(1758834838.339:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.065656][ T5997] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 202.080957][ T30] audit: type=1326 audit(1758834838.339:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.123642][ T30] audit: type=1326 audit(1758834838.339:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.151596][ T30] audit: type=1326 audit(1758834838.339:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa298b8d710 code=0x7ffc0000 [ 202.189027][ T30] audit: type=1326 audit(1758834838.339:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.217293][ T5997] usb 3-1: device descriptor read/64, error -71 [ 202.231414][ T30] audit: type=1326 audit(1758834838.339:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7776 comm="syz.3.472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 202.337053][ T5997] usb usb3-port1: attempt power cycle [ 202.464761][ T43] usb 2-1: new full-speed USB device number 28 using dummy_hcd [ 202.637901][ T7794] team0: Device ipip0 is of different type [ 202.678317][ T43] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.691006][ T43] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 202.705365][ T5940] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 202.713019][ T5997] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 202.732059][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 202.798233][ T5997] usb 3-1: device descriptor read/8, error -71 [ 202.855136][ T5940] usb 1-1: device descriptor read/64, error -71 [ 202.905324][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 202.956010][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 203.104526][ T5997] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 203.154545][ T5940] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 203.173307][ T43] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 203.182933][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 203.204943][ T5997] usb 3-1: device descriptor read/8, error -71 [ 203.221330][ T43] usb 2-1: Product: syz [ 203.225895][ T43] usb 2-1: Manufacturer: syz [ 203.265788][ T43] usb 2-1: SerialNumber: syz [ 203.339070][ T5997] usb usb3-port1: unable to enumerate USB device [ 203.345781][ T5940] usb 1-1: device descriptor read/64, error -71 [ 203.376110][ T43] usb 2-1: config 0 descriptor?? [ 203.485089][ T5940] usb usb1-port1: attempt power cycle [ 203.583704][ T43] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 203.590539][ T43] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 203.784866][ T43] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 203.806206][ T43] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 203.825000][ T5940] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 203.837829][ T43] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 203.876344][ T43] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 203.884032][ T5940] usb 1-1: device descriptor read/8, error -71 [ 204.144535][ T5940] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 204.165125][ T5940] usb 1-1: device descriptor read/8, error -71 [ 204.277183][ T5940] usb usb1-port1: unable to enumerate USB device [ 204.719536][ T43] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 204.736704][ T43] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 204.881516][ T43] usb 2-1: USB disconnect, device number 28 [ 205.454118][ T7825] team_slave_0: entered promiscuous mode [ 205.460197][ T7825] team_slave_1: entered promiscuous mode [ 205.480250][ T7825] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 205.527727][ T7832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.567681][ T7825] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 205.672962][ T7825] netlink: 132 bytes leftover after parsing attributes in process `syz.4.484'. [ 205.693725][ T7832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.784572][ T5940] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 205.955706][ T5940] usb 2-1: Using ep0 maxpacket: 32 [ 206.003461][ T5940] usb 2-1: unable to get BOS descriptor or descriptor too short [ 206.067887][ T5940] usb 2-1: config 5 has an invalid interface number: 52 but max is 0 [ 206.091641][ T5940] usb 2-1: config 5 has no interface number 0 [ 206.101800][ T5940] usb 2-1: config 5 interface 52 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 206.168747][ T5940] usb 2-1: string descriptor 0 read error: -22 [ 206.178440][ T5940] usb 2-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice=51.58 [ 206.189172][ T5940] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.277751][ T7831] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 206.294219][ T5940] aircable 2-1:5.52: aircable converter detected [ 206.304962][ T10] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 206.417913][ T5940] usb 2-1: aircable converter now attached to ttyUSB0 [ 206.454872][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 206.470975][ T10] usb 5-1: too many endpoints for config 64 interface 0 altsetting 8: 33, using maximum allowed: 30 [ 206.490624][ T10] usb 5-1: config 64 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.558991][ T10] usb 5-1: config 64 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.581225][ T9] usb 2-1: USB disconnect, device number 29 [ 206.597215][ T9] aircable ttyUSB0: aircable converter now disconnected from ttyUSB0 [ 206.611028][ T10] usb 5-1: config 64 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 206.631439][ T9] aircable 2-1:5.52: device disconnected [ 206.662045][ T10] usb 5-1: config 64 interface 0 has no altsetting 0 [ 206.678160][ T10] usb 5-1: New USB device found, idVendor=17ef, idProduct=6085, bcdDevice= 0.00 [ 206.732818][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.864585][ T5940] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 207.004225][ T7842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.021677][ T7842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.024692][ T5940] usb 4-1: Using ep0 maxpacket: 16 [ 207.046104][ T5940] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 207.081330][ T5940] usb 4-1: config 1 has no interface number 0 [ 207.097996][ T5940] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 207.112662][ T5940] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 207.138467][ T5940] usb 4-1: config 1 interface 105 has no altsetting 0 [ 207.240941][ T10] hid-rmi 0003:17EF:6085.000A: unknown main item tag 0x0 [ 207.257582][ T10] hid-rmi 0003:17EF:6085.000A: unknown main item tag 0x0 [ 207.266502][ T5940] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 207.276281][ T10] hid-rmi 0003:17EF:6085.000A: unknown main item tag 0x0 [ 207.278534][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.293477][ T10] hid-rmi 0003:17EF:6085.000A: unknown main item tag 0x0 [ 207.301232][ T10] hid-rmi 0003:17EF:6085.000A: unknown main item tag 0x0 [ 207.361145][ T10] hid-rmi 0003:17EF:6085.000A: hidraw0: USB HID v0.00 Device [HID 17ef:6085] on usb-dummy_hcd.4-1/input0 [ 207.362623][ T5940] usb 4-1: Product: syz [ 207.465419][ T5940] usb 4-1: Manufacturer: syz [ 207.470265][ T5940] usb 4-1: SerialNumber: syz [ 207.501095][ T7844] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 207.518478][ T7844] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 207.541080][ T10] usb 5-1: USB disconnect, device number 32 [ 207.594922][ T5933] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 207.672614][ T7859] fido_id[7859]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 207.765288][ T5933] usb 2-1: unable to get BOS descriptor or descriptor too short [ 207.780359][ T5933] usb 2-1: not running at top speed; connect to a high speed hub [ 207.800730][ T5933] usb 2-1: config 1 has an invalid interface number: 138 but max is 0 [ 207.845127][ T5933] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.939683][ T5933] usb 2-1: config 1 has no interface number 0 [ 207.947337][ T5933] usb 2-1: config 1 interface 138 altsetting 252 endpoint 0x7 has invalid wMaxPacketSize 0 [ 207.958001][ T5933] usb 2-1: config 1 interface 138 has no altsetting 0 [ 207.978972][ T7844] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 207.986581][ T7844] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 207.994097][ T5933] usb 2-1: New USB device found, idVendor=0cb8, idProduct=c90b, bcdDevice= d.ae [ 208.004677][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.012886][ T5933] usb 2-1: Product: syz [ 208.024944][ T5933] usb 2-1: Manufacturer: syz [ 208.034301][ T5933] usb 2-1: SerialNumber: syz [ 208.308983][ T5933] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 208.432716][ T5933] usb 2-1: USB disconnect, device number 30 [ 208.453407][ T5940] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 208.525165][ T5940] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 208.542206][ T6012] udevd[6012]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.138/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 208.575477][ T5940] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 208.674320][ T7869] netlink: 'syz.0.494': attribute type 6 has an invalid length. [ 208.682318][ T7869] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.494'. [ 208.695288][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 208.696378][ T30] audit: type=1400 audit(1758834845.359:679): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name="#" pid=7863 comm="syz.0.494" [ 208.793804][ T5940] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 36:ed:7f:fb:f8:49 [ 208.821332][ T7869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.866713][ T5940] usb 4-1: USB disconnect, device number 32 [ 208.933759][ T5940] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 209.066104][ T5940] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 209.086231][ T7873] netlink: 68 bytes leftover after parsing attributes in process `syz.4.493'. [ 209.122112][ T5940] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 209.149931][ T7878] netlink: 24 bytes leftover after parsing attributes in process `syz.1.498'. [ 209.234663][ T5940] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 209.256444][ T7881] sch_tbf: burst 511 is lower than device veth5 mtu (1514) ! [ 209.636384][ T43] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 209.660189][ T7886] netlink: zone id is out of range [ 209.699733][ T7886] netlink: set zone limit has 4 unknown bytes [ 209.807215][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 209.837618][ T43] usb 2-1: not running at top speed; connect to a high speed hub [ 209.864513][ T5940] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 209.943938][ T43] usb 2-1: config 17 has an invalid interface number: 8 but max is 1 [ 209.977060][ T43] usb 2-1: config 17 has 1 interface, different from the descriptor's value: 2 [ 210.026851][ T43] usb 2-1: config 17 has no interface number 0 [ 210.075688][ T43] usb 2-1: config 17 interface 8 altsetting 6 endpoint 0x3 has an invalid bInterval 0, changing to 4 [ 210.148967][ T43] usb 2-1: config 17 interface 8 has no altsetting 0 [ 210.160929][ T43] usb 2-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice=2c.ff [ 210.172569][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.197183][ T43] usb 2-1: Product: syz [ 210.208206][ T7897] netlink: 28 bytes leftover after parsing attributes in process `syz.2.504'. [ 210.212620][ T43] usb 2-1: Manufacturer: syz [ 210.232886][ T7897] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 210.244838][ T43] usb 2-1: SerialNumber: syz [ 210.386214][ T7898] netlink: 28 bytes leftover after parsing attributes in process `syz.3.503'. [ 210.533691][ T43] usb 2-1: selecting invalid altsetting 0 [ 210.598793][ T9] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 210.616151][ T43] usb 2-1: 8:6 : no UAC_FORMAT_TYPE desc [ 210.621930][ T7898] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 210.649052][ T43] usb 2-1: selecting invalid altsetting 0 [ 211.029676][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 211.164308][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 211.216117][ T43] usb 2-1: USB disconnect, device number 31 [ 211.260305][ T9] usb 5-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 211.306158][ T5967] udevd[5967]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.8/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 211.343611][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.419998][ T9] usb 5-1: config 0 descriptor?? [ 211.805712][ T7918] fuse: Unknown parameter 'ro4otmode' [ 211.833696][ T7918] fuse: Bad value for 'fd' [ 211.851676][ T7902] netlink: 24 bytes leftover after parsing attributes in process `syz.4.505'. [ 211.913178][ T9] megaworld 0003:07B5:0312.000B: ignoring exceeding usage max [ 211.981568][ T9] megaworld 0003:07B5:0312.000B: hidraw0: USB HID v0.00 Device [HID 07b5:0312] on usb-dummy_hcd.4-1/input0 [ 212.027147][ T5933] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 212.034797][ T9] megaworld 0003:07B5:0312.000B: no inputs found [ 212.116144][ T43] usb 5-1: USB disconnect, device number 33 [ 212.216834][ T5933] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.228347][ T5933] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 212.239182][ T5933] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 212.252516][ T5933] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 212.262081][ T5933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.277924][ T5933] usb 1-1: config 0 descriptor?? [ 212.294655][ T5940] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 212.456262][ T5940] usb 4-1: config 0 has an invalid interface number: 229 but max is 0 [ 212.465948][ T5940] usb 4-1: config 0 has no interface number 0 [ 212.474186][ T5940] usb 4-1: New USB device found, idVendor=0781, idProduct=55e8, bcdDevice=44.f3 [ 212.486527][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.495689][ T5940] usb 4-1: Product: syz [ 212.499877][ T5940] usb 4-1: Manufacturer: syz [ 212.504604][ T5940] usb 4-1: SerialNumber: syz [ 212.512892][ T5940] usb 4-1: config 0 descriptor?? [ 212.722042][ T5933] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 212.749183][ T5940] usb-storage 4-1:0.229: USB Mass Storage device detected [ 212.792577][ T5940] usb-storage 4-1:0.229: Quirks match for vid 0781 pid 55e8: 800000 [ 212.892805][ T5940] usb 4-1: USB disconnect, device number 33 [ 213.042106][ T43] usb 1-1: USB disconnect, device number 25 [ 213.608012][ T7953] netlink: 28 bytes leftover after parsing attributes in process `syz.3.518'. [ 213.635006][ T7953] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 214.224187][ T7961] netlink: 36 bytes leftover after parsing attributes in process `syz.0.521'. [ 214.276001][ T7961] netlink: 36 bytes leftover after parsing attributes in process `syz.0.521'. [ 214.425594][ T7961] netlink: 492 bytes leftover after parsing attributes in process `syz.0.521'. [ 214.770056][ T7974] syzkaller1: entered promiscuous mode [ 214.802943][ T7974] syzkaller1: entered allmulticast mode [ 214.864730][ T5933] usb 2-1: new low-speed USB device number 32 using dummy_hcd [ 215.075256][ T5933] usb 2-1: Invalid ep0 maxpacket: 16 [ 215.222330][ T5933] usb 2-1: new low-speed USB device number 33 using dummy_hcd [ 215.294947][ T5959] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 215.424933][ T5959] usb 1-1: device descriptor read/64, error -71 [ 215.435337][ T5933] usb 2-1: Invalid ep0 maxpacket: 16 [ 215.441255][ T5933] usb usb2-port1: attempt power cycle [ 215.665108][ T5959] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 215.734902][ T43] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 215.784847][ T5933] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 215.832377][ T5933] usb 2-1: Invalid ep0 maxpacket: 16 [ 215.852600][ T5959] usb 1-1: device descriptor read/64, error -71 [ 215.938629][ T43] usb 5-1: config 0 has no interfaces? [ 215.974061][ T43] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 215.974739][ T5933] usb 2-1: new low-speed USB device number 35 using dummy_hcd [ 216.012698][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.050766][ T5959] usb usb1-port1: attempt power cycle [ 216.110424][ T43] usb 5-1: Product: syz [ 216.115909][ T43] usb 5-1: Manufacturer: syz [ 216.120677][ T43] usb 5-1: SerialNumber: syz [ 216.131358][ T43] usb 5-1: config 0 descriptor?? [ 216.138172][ T5933] usb 2-1: Invalid ep0 maxpacket: 16 [ 216.188895][ T5933] usb usb2-port1: unable to enumerate USB device [ 216.362480][ T7982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.373247][ T7982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.392944][ T7982] loop6: detected capacity change from 0 to 524288000 [ 216.408746][ T5959] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 216.436945][ T5959] usb 1-1: device descriptor read/8, error -71 [ 216.444874][ T7982] support for the xor transformation has been removed. [ 216.694958][ T5959] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 216.735428][ T5959] usb 1-1: device descriptor read/8, error -71 [ 216.845396][ T5959] usb usb1-port1: unable to enumerate USB device [ 218.293516][ T43] usb 5-1: USB disconnect, device number 34 [ 218.601639][ T8032] netlink: 28 bytes leftover after parsing attributes in process `syz.3.538'. [ 218.629005][ T8033] netlink: 'syz.4.537': attribute type 6 has an invalid length. [ 218.637223][ T8033] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.537'. [ 218.647102][ T30] audit: type=1400 audit(1758834855.319:680): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name="#" pid=8023 comm="syz.4.537" [ 218.716431][ T8032] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 218.843531][ T8034] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.394945][ T5959] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 219.759668][ T8042] FAULT_INJECTION: forcing a failure. [ 219.759668][ T8042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 219.784878][ T5959] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 219.803817][ T8042] CPU: 1 UID: 0 PID: 8042 Comm: syz.2.540 Not tainted syzkaller #0 PREEMPT(full) [ 219.803841][ T8042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 219.803849][ T8042] Call Trace: [ 219.803854][ T8042] [ 219.803859][ T8042] dump_stack_lvl+0x189/0x250 [ 219.803876][ T8042] ? __pfx____ratelimit+0x10/0x10 [ 219.803888][ T8042] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.803899][ T8042] ? __pfx__printk+0x10/0x10 [ 219.803913][ T8042] ? __might_fault+0xb0/0x130 [ 219.803947][ T8042] should_fail_ex+0x414/0x560 [ 219.803965][ T8042] _copy_from_user+0x2d/0xb0 [ 219.803978][ T8042] __sys_connect+0x123/0x440 [ 219.803991][ T8042] ? __pfx___sys_connect+0x10/0x10 [ 219.804007][ T8042] ? __pfx_ksys_write+0x10/0x10 [ 219.804020][ T8042] ? rcu_is_watching+0x15/0xb0 [ 219.804034][ T8042] __x64_sys_connect+0x7a/0x90 [ 219.804045][ T8042] do_syscall_64+0xfa/0x3b0 [ 219.804056][ T8042] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.804065][ T8042] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 219.804074][ T8042] ? clear_bhb_loop+0x60/0xb0 [ 219.804085][ T8042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.804094][ T8042] RIP: 0033:0x7efea318eec9 [ 219.804104][ T8042] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.804112][ T8042] RSP: 002b:00007efea3fc4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 219.804123][ T8042] RAX: ffffffffffffffda RBX: 00007efea33e5fa0 RCX: 00007efea318eec9 [ 219.804135][ T8042] RDX: 0000000000000026 RSI: 0000200000000000 RDI: 0000000000000004 [ 219.804142][ T8042] RBP: 00007efea3fc4090 R08: 0000000000000000 R09: 0000000000000000 [ 219.804148][ T8042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 219.804153][ T8042] R13: 00007efea33e6038 R14: 00007efea33e5fa0 R15: 00007efea350fa28 [ 219.804168][ T8042] [ 219.984414][ T5959] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 220.025358][ T5959] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 220.070997][ T8044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.125852][ T8044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 220.184888][ T5959] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 220.194318][ T5959] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.293792][ T5959] usb 1-1: Product: syz [ 220.298689][ T10] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 220.341698][ T5959] usb 1-1: Manufacturer: syz [ 220.350065][ T5959] usb 1-1: SerialNumber: syz [ 220.395057][ T5959] usb 1-1: config 0 descriptor?? [ 220.414678][ T5959] usb-storage 1-1:0.0: USB Mass Storage device detected [ 220.429305][ T5959] usb-storage 1-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 220.455167][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 220.465506][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 220.502834][ T10] usb 4-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 220.584673][ T30] audit: type=1326 audit(1758834857.269:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 220.664476][ T30] audit: type=1326 audit(1758834857.269:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 220.787595][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.825134][ T30] audit: type=1326 audit(1758834857.269:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 220.826190][ T10] usb 4-1: Product: syz [ 221.092286][ T10] usb 4-1: Manufacturer: syz [ 221.101729][ T10] usb 4-1: SerialNumber: syz [ 221.111713][ T5959] usb 1-1: USB disconnect, device number 30 [ 221.135143][ T30] audit: type=1326 audit(1758834857.269:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.158299][ T10] usb 4-1: config 0 descriptor?? [ 221.170343][ T10] hub 4-1:0.0: bad descriptor, ignoring hub [ 221.185780][ T10] hub 4-1:0.0: probe with driver hub failed with error -5 [ 221.232973][ T30] audit: type=1326 audit(1758834857.269:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.256845][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 221.277040][ T30] audit: type=1326 audit(1758834857.269:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.338438][ T30] audit: type=1326 audit(1758834857.269:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.391714][ T10] usb 4-1: USB disconnect, device number 34 [ 221.421914][ T30] audit: type=1326 audit(1758834857.269:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.469500][ T30] audit: type=1326 audit(1758834857.269:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8062 comm="syz.1.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6da838eec9 code=0x7ffc0000 [ 221.472311][ T6247] udevd[6247]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 221.726551][ T8082] netlink: 20 bytes leftover after parsing attributes in process `syz.1.551'. [ 221.828202][ T8085] loop6: detected capacity change from 0 to 7 [ 221.870032][ T8085] Dev loop6: unable to read RDB block 7 [ 221.898550][ T8085] loop6: unable to read partition table [ 221.934804][ T8085] loop6: partition table beyond EOD, truncated [ 221.994655][ T8085] loop_reread_partitions: partition scan of loop6 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 222.296155][ T8103] netlink: 'syz.0.555': attribute type 6 has an invalid length. [ 222.304092][ T8103] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.555'. [ 222.313432][ T5940] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 222.356945][ T8103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 222.460524][ T8107] netlink: 12 bytes leftover after parsing attributes in process `syz.3.558'. [ 222.469709][ T8107] netlink: 18 bytes leftover after parsing attributes in process `syz.3.558'. [ 222.486982][ T5940] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 222.495611][ T5940] usb 3-1: config 0 has no interface number 0 [ 222.520767][ T5940] usb 3-1: too many endpoints for config 0 interface 1 altsetting 123: 254, using maximum allowed: 30 [ 222.570901][ T5940] usb 3-1: config 0 interface 1 altsetting 123 has 0 endpoint descriptors, different from the interface descriptor's value: 254 [ 222.627164][ T8110] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 222.641617][ T8110] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 222.696548][ T5940] usb 3-1: config 0 interface 1 has no altsetting 0 [ 222.750686][ T5940] usb 3-1: New USB device found, idVendor=0b48, idProduct=1004, bcdDevice=8c.1e [ 222.805953][ T5940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.925774][ T5940] usb 3-1: config 0 descriptor?? [ 223.169673][ T8085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.181459][ T8085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.624809][ T10] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 223.725010][ T5959] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 223.774813][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 223.784255][ T8129] netlink: 'syz.3.564': attribute type 17 has an invalid length. [ 223.797795][ T8129] netlink: 8 bytes leftover after parsing attributes in process `syz.3.564'. [ 223.834934][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 223.846604][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 223.854920][ T5959] usb 2-1: device descriptor read/64, error -71 [ 223.877627][ T10] usb 4-1: can't read configurations, error -71 [ 224.035507][ T5940] usb 3-1: string descriptor 0 read error: -71 [ 224.124746][ T5959] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 224.327538][ T5959] usb 2-1: device descriptor read/64, error -71 [ 224.445447][ T5959] usb usb2-port1: attempt power cycle [ 224.462062][ T5940] usb 3-1: selecting invalid altsetting 1 [ 224.472691][ T5940] dvb_ttusb_budget: ttusb_init_controller: error [ 224.489728][ T5940] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 224.617482][ T5940] DVB: Unable to find symbol ves1820_attach() [ 224.801975][ T5940] DVB: Unable to find symbol stv0297_attach() [ 224.810833][ T5940] dvb_ttusb_budget: no frontend driver found for device [0b48:1004] [ 224.833342][ T5940] usb 3-1: USB disconnect, device number 36 [ 224.835310][ T5959] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 224.886306][ T5959] usb 2-1: device descriptor read/8, error -71 [ 225.002863][ T43] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 225.134917][ T5959] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 225.177613][ T43] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 225.198355][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.264759][ T43] usb 5-1: config 0 descriptor?? [ 225.289694][ T5959] usb 2-1: device descriptor read/8, error -71 [ 225.334674][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 225.423097][ T5959] usb usb2-port1: unable to enumerate USB device [ 225.511109][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.522926][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 225.549763][ T10] usb 1-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 225.559493][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.580408][ T10] usb 1-1: config 0 descriptor?? [ 226.361750][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 226.377983][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 226.424262][ T10] usb 1-1: USB disconnect, device number 31 [ 227.272249][ T30] kauditd_printk_skb: 69 callbacks suppressed [ 227.272266][ T30] audit: type=1326 audit(1758834863.959:759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.333964][ T30] audit: type=1326 audit(1758834863.959:760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.359662][ T30] audit: type=1326 audit(1758834863.999:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.382969][ T30] audit: type=1326 audit(1758834863.999:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.406137][ T30] audit: type=1326 audit(1758834863.999:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.463481][ T30] audit: type=1326 audit(1758834863.999:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.495333][ T5940] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 227.503335][ T30] audit: type=1326 audit(1758834863.999:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.528608][ T30] audit: type=1326 audit(1758834863.999:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.553619][ T30] audit: type=1326 audit(1758834863.999:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.577337][ T30] audit: type=1326 audit(1758834863.999:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8169 comm="syz.3.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fa298b8eec9 code=0x7ffc0000 [ 227.647142][ T5940] usb 1-1: config 0 has an invalid interface number: 255 but max is 2 [ 227.662631][ T5940] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 227.681214][ T5940] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 227.691753][ T5940] usb 1-1: config 0 has no interface number 0 [ 227.698263][ T5940] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 227.711843][ T5940] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 227.725779][ T5940] usb 1-1: config 0 interface 255 has no altsetting 0 [ 227.733045][ T5940] usb 1-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 227.761984][ T5940] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.800860][ T5940] usb 1-1: config 0 descriptor?? [ 227.970106][ T8182] capability: warning: `syz.2.578' uses 32-bit capabilities (legacy support in use) [ 228.007020][ T43] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 228.029793][ T5940] usb 1-1: USB disconnect, device number 32 [ 228.043456][ T43] [drm:udl_init] *ERROR* Selecting channel failed [ 228.118089][ T43] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 228.145262][ T43] [drm] Initialized udl on minor 2 [ 228.197951][ T43] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 228.245654][ T43] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 228.286681][ T5940] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 228.358306][ T43] usb 5-1: USB disconnect, device number 35 [ 228.368963][ T5940] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 228.383212][ T8193] netlink: 'syz.2.580': attribute type 6 has an invalid length. [ 228.391076][ T8193] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.580'. [ 228.441000][ T8193] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 228.903003][ T5940] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 229.031191][ T8202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.583'. [ 229.045852][ T8202] netlink: 156 bytes leftover after parsing attributes in process `syz.1.583'. [ 229.206850][ T5940] usb 1-1: unable to get BOS descriptor or descriptor too short [ 229.218094][ T5940] usb 1-1: not running at top speed; connect to a high speed hub [ 229.242537][ T5940] usb 1-1: config 6 has an invalid interface number: 30 but max is 0 [ 229.260774][ T5940] usb 1-1: config 6 contains an unexpected descriptor of type 0x1, skipping [ 229.348397][ T5940] usb 1-1: config 6 has an invalid interface number: 1 but max is 0 [ 229.404619][ T5940] usb 1-1: config 6 has an invalid descriptor of length 196, skipping remainder of the config [ 229.547883][ T5940] usb 1-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 229.567446][ T5940] usb 1-1: config 6 has no interface number 0 [ 229.607144][ T5940] usb 1-1: config 6 interface 30 altsetting 0 has an invalid endpoint descriptor of length 5, skipping [ 229.636152][ T8207] tipc: Can't bind to reserved service type 2 [ 229.719039][ T5940] usb 1-1: config 6 interface 30 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 229.761190][ T5940] usb 1-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=1e.11 [ 229.801589][ T5940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.887820][ T5940] usb 1-1: Product: syz [ 229.918646][ T5940] usb 1-1: Manufacturer: syz [ 229.930215][ T5940] usb 1-1: SerialNumber: syz [ 230.808041][ T5940] usbtest 1-1:6.30: couldn't get endpoints, -22 [ 230.827921][ T5940] usbtest 1-1:6.30: probe with driver usbtest failed with error -22 [ 230.850562][ T5940] usbtest 1-1:6.1: couldn't get endpoints, -22 [ 230.867184][ T5940] usbtest 1-1:6.1: probe with driver usbtest failed with error -22 [ 230.930115][ T5940] usb 1-1: USB disconnect, device number 33 [ 231.336317][ T8225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.587'. [ 232.274474][ T9] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 232.446072][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 232.478860][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 232.521264][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 29696, setting to 64 [ 232.582203][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 232.633144][ T9] usb 4-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 232.659850][ T9] usb 4-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 232.694881][ T9] usb 4-1: Product: syz [ 232.699079][ T9] usb 4-1: Manufacturer: syz [ 232.822201][ T9] usb 4-1: SerialNumber: syz [ 232.843587][ T9] usb 4-1: config 0 descriptor?? [ 232.864195][ T9] smsusb:smsusb_probe: board id=2, interface number 0 [ 232.893007][ T9] smsusb:siano_media_device_register: media controller created [ 232.910748][ T9] smsusb:smsusb_start_streaming: smsusb_submit_urb(...) failed [ 232.950613][ T9] smsusb:smsusb_init_device: smsusb_start_streaming(...) failed [ 232.992912][ T9] ------------[ cut here ]------------ [ 232.998503][ T9] WARNING: CPU: 0 PID: 9 at mm/slub.c:4805 free_large_kmalloc+0x15c/0x1f0 [ 233.007343][ T9] Modules linked in: [ 233.011674][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 233.021268][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 233.031733][ T9] Workqueue: usb_hub_wq hub_event [ 233.037349][ T9] RIP: 0010:free_large_kmalloc+0x15c/0x1f0 [ 233.043177][ T9] Code: 44 89 f6 e8 b6 19 fd ff 65 48 8b 05 3e 7b 88 10 48 3b 44 24 08 75 57 48 83 c4 10 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 90 <0f> 0b 90 65 48 8b 05 19 7b 88 10 48 3b 44 24 08 75 32 48 89 df 48 [ 233.063864][ T9] RSP: 0018:ffffc900000e6b00 EFLAGS: 00010206 [ 233.071078][ T9] RAX: 00000000ff000000 RBX: ffffea0001235880 RCX: 0000000000000000 [ 233.079561][ T9] RDX: ffffc90019ee5000 RSI: ffff888048d62000 RDI: ffffea0001235880 [ 233.087948][ T9] RBP: 0000000000000100 R08: ffff88807e5a2d03 R09: 1ffff1100fcb45a0 [ 233.096298][ T9] R10: dffffc0000000000 R11: ffffed100fcb45a1 R12: 1ffff1100f1d3482 [ 233.104308][ T9] R13: 0000000000000000 R14: ffff88807e5a2d60 R15: dffffc0000000000 [ 233.112542][ T9] FS: 0000000000000000(0000) GS:ffff888125c12000(0000) knlGS:0000000000000000 [ 233.121636][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 233.128501][ T9] CR2: 000055557a0de588 CR3: 000000007b822000 CR4: 00000000003526f0 [ 233.137018][ T9] Call Trace: [ 233.140321][ T9] [ 233.143269][ T9] usb_free_urb+0xd0/0x120 [ 233.148283][ T9] smsusb_term_device+0x1d6/0x3b0 [ 233.153366][ T9] smsusb_probe+0x1a04/0x2060 [ 233.158631][ T9] ? __pfx_smsusb_probe+0x10/0x10 [ 233.164956][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10 [ 233.172057][ T9] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 233.178508][ T9] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 233.185445][ T9] ? __pm_runtime_set_status+0x785/0xa50 [ 233.191107][ T9] usb_probe_interface+0x668/0xc30 [ 233.196772][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 233.202442][ T9] really_probe+0x26a/0x9e0 [ 233.207684][ T9] __driver_probe_device+0x18c/0x2f0 [ 233.213017][ T9] driver_probe_device+0x4f/0x430 [ 233.218625][ T9] __device_attach_driver+0x2ce/0x530 [ 233.224038][ T9] bus_for_each_drv+0x251/0x2e0 [ 233.229167][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 233.235219][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 233.240631][ T9] __device_attach+0x2b8/0x400 [ 233.245558][ T9] ? __pfx___device_attach+0x10/0x10 [ 233.250875][ T9] ? do_raw_spin_unlock+0x122/0x240 [ 233.256633][ T9] bus_probe_device+0x185/0x260 [ 233.261519][ T9] device_add+0x7b6/0xb50 [ 233.267658][ T9] usb_set_configuration+0x1a87/0x20e0 [ 233.274244][ T9] usb_generic_driver_probe+0x8d/0x150 [ 233.280384][ T9] usb_probe_device+0x1c4/0x390 [ 233.286022][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 233.291439][ T9] really_probe+0x26a/0x9e0 [ 233.296522][ T9] __driver_probe_device+0x18c/0x2f0 [ 233.301870][ T9] driver_probe_device+0x4f/0x430 [ 233.307381][ T9] __device_attach_driver+0x2ce/0x530 [ 233.312769][ T9] bus_for_each_drv+0x251/0x2e0 [ 233.318143][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 233.324055][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 233.330015][ T9] __device_attach+0x2b8/0x400 [ 233.335394][ T9] ? __pfx___device_attach+0x10/0x10 [ 233.340714][ T9] ? do_raw_spin_unlock+0x122/0x240 [ 233.346077][ T9] bus_probe_device+0x185/0x260 [ 233.350930][ T9] device_add+0x7b6/0xb50 [ 233.355326][ T9] usb_new_device+0xa39/0x16f0 [ 233.360095][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 233.365443][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.371946][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.378201][ T9] hub_event+0x2958/0x4a20 [ 233.382725][ T9] ? __pfx_hub_event+0x10/0x10 [ 233.388364][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.394122][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.400131][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.406443][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.412184][ T9] process_scheduled_works+0xae1/0x17b0 [ 233.418317][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 233.424843][ T9] worker_thread+0x8a0/0xda0 [ 233.429488][ T9] kthread+0x70e/0x8a0 [ 233.433578][ T9] ? __pfx_worker_thread+0x10/0x10 [ 233.439225][ T9] ? __pfx_kthread+0x10/0x10 [ 233.443845][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.449681][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.455529][ T9] ? __pfx_kthread+0x10/0x10 [ 233.460158][ T9] ret_from_fork+0x439/0x7d0 [ 233.465358][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 233.471791][ T9] ? __switch_to_asm+0x39/0x70 [ 233.477968][ T9] ? __switch_to_asm+0x33/0x70 [ 233.482769][ T9] ? __pfx_kthread+0x10/0x10 [ 233.487531][ T9] ret_from_fork_asm+0x1a/0x30 [ 233.492353][ T9] [ 233.495471][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 233.502774][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 233.511898][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 233.522017][ T9] Workqueue: usb_hub_wq hub_event [ 233.527084][ T9] Call Trace: [ 233.530391][ T9] [ 233.533350][ T9] dump_stack_lvl+0x99/0x250 [ 233.537960][ T9] ? __asan_memcpy+0x40/0x70 [ 233.542567][ T9] ? __pfx_dump_stack_lvl+0x10/0x10 [ 233.547802][ T9] ? __pfx__printk+0x10/0x10 [ 233.552436][ T9] vpanic+0x281/0x750 [ 233.556440][ T9] ? __pfx__printk+0x10/0x10 [ 233.561053][ T9] ? __pfx_vpanic+0x10/0x10 [ 233.565574][ T9] ? is_bpf_text_address+0x26/0x2b0 [ 233.570801][ T9] panic+0xb9/0xc0 [ 233.574569][ T9] ? __pfx_panic+0x10/0x10 [ 233.579016][ T9] __warn+0x31b/0x4b0 [ 233.583000][ T9] ? free_large_kmalloc+0x15c/0x1f0 [ 233.588199][ T9] ? free_large_kmalloc+0x15c/0x1f0 [ 233.593390][ T9] report_bug+0x2be/0x4f0 [ 233.597713][ T9] ? free_large_kmalloc+0x15c/0x1f0 [ 233.602906][ T9] ? free_large_kmalloc+0x15c/0x1f0 [ 233.608109][ T9] ? free_large_kmalloc+0x15e/0x1f0 [ 233.613358][ T9] handle_bug+0x84/0x160 [ 233.617608][ T9] exc_invalid_op+0x1a/0x50 [ 233.622108][ T9] asm_exc_invalid_op+0x1a/0x20 [ 233.626950][ T9] RIP: 0010:free_large_kmalloc+0x15c/0x1f0 [ 233.632749][ T9] Code: 44 89 f6 e8 b6 19 fd ff 65 48 8b 05 3e 7b 88 10 48 3b 44 24 08 75 57 48 83 c4 10 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 90 <0f> 0b 90 65 48 8b 05 19 7b 88 10 48 3b 44 24 08 75 32 48 89 df 48 [ 233.652345][ T9] RSP: 0018:ffffc900000e6b00 EFLAGS: 00010206 [ 233.658411][ T9] RAX: 00000000ff000000 RBX: ffffea0001235880 RCX: 0000000000000000 [ 233.666371][ T9] RDX: ffffc90019ee5000 RSI: ffff888048d62000 RDI: ffffea0001235880 [ 233.674337][ T9] RBP: 0000000000000100 R08: ffff88807e5a2d03 R09: 1ffff1100fcb45a0 [ 233.682308][ T9] R10: dffffc0000000000 R11: ffffed100fcb45a1 R12: 1ffff1100f1d3482 [ 233.690277][ T9] R13: 0000000000000000 R14: ffff88807e5a2d60 R15: dffffc0000000000 [ 233.698348][ T9] usb_free_urb+0xd0/0x120 [ 233.702763][ T9] smsusb_term_device+0x1d6/0x3b0 [ 233.707787][ T9] smsusb_probe+0x1a04/0x2060 [ 233.712475][ T9] ? __pfx_smsusb_probe+0x10/0x10 [ 233.717499][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10 [ 233.723038][ T9] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 233.728933][ T9] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 233.735276][ T9] ? __pm_runtime_set_status+0x785/0xa50 [ 233.740932][ T9] usb_probe_interface+0x668/0xc30 [ 233.746058][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 233.751680][ T9] really_probe+0x26a/0x9e0 [ 233.756182][ T9] __driver_probe_device+0x18c/0x2f0 [ 233.761463][ T9] driver_probe_device+0x4f/0x430 [ 233.766485][ T9] __device_attach_driver+0x2ce/0x530 [ 233.771859][ T9] bus_for_each_drv+0x251/0x2e0 [ 233.776697][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 233.782584][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 233.787986][ T9] __device_attach+0x2b8/0x400 [ 233.792772][ T9] ? __pfx___device_attach+0x10/0x10 [ 233.798055][ T9] ? do_raw_spin_unlock+0x122/0x240 [ 233.803252][ T9] bus_probe_device+0x185/0x260 [ 233.808101][ T9] device_add+0x7b6/0xb50 [ 233.812432][ T9] usb_set_configuration+0x1a87/0x20e0 [ 233.817908][ T9] usb_generic_driver_probe+0x8d/0x150 [ 233.823357][ T9] usb_probe_device+0x1c4/0x390 [ 233.828202][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 233.833561][ T9] really_probe+0x26a/0x9e0 [ 233.838060][ T9] __driver_probe_device+0x18c/0x2f0 [ 233.843336][ T9] driver_probe_device+0x4f/0x430 [ 233.848349][ T9] __device_attach_driver+0x2ce/0x530 [ 233.853713][ T9] bus_for_each_drv+0x251/0x2e0 [ 233.858653][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 233.864552][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 233.869936][ T9] __device_attach+0x2b8/0x400 [ 233.874716][ T9] ? __pfx___device_attach+0x10/0x10 [ 233.880017][ T9] ? do_raw_spin_unlock+0x122/0x240 [ 233.885239][ T9] bus_probe_device+0x185/0x260 [ 233.890094][ T9] device_add+0x7b6/0xb50 [ 233.894427][ T9] usb_new_device+0xa39/0x16f0 [ 233.899202][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 233.904393][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.909587][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.914774][ T9] hub_event+0x2958/0x4a20 [ 233.919227][ T9] ? __pfx_hub_event+0x10/0x10 [ 233.923981][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.929690][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.934878][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.940584][ T9] ? process_scheduled_works+0x9ef/0x17b0 [ 233.946289][ T9] process_scheduled_works+0xae1/0x17b0 [ 233.951853][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 233.957922][ T9] worker_thread+0x8a0/0xda0 [ 233.962525][ T9] kthread+0x70e/0x8a0 [ 233.966607][ T9] ? __pfx_worker_thread+0x10/0x10 [ 233.971701][ T9] ? __pfx_kthread+0x10/0x10 [ 233.976278][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 233.981467][ T9] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.986653][ T9] ? __pfx_kthread+0x10/0x10 [ 233.991241][ T9] ret_from_fork+0x439/0x7d0 [ 233.995834][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 234.000945][ T9] ? __switch_to_asm+0x39/0x70 [ 234.005695][ T9] ? __switch_to_asm+0x33/0x70 [ 234.010445][ T9] ? __pfx_kthread+0x10/0x10 [ 234.015027][ T9] ret_from_fork_asm+0x1a/0x30 [ 234.019802][ T9] [ 234.023096][ T9] Kernel Offset: disabled [ 234.027403][ T9] Rebooting in 86400 seconds..