last executing test programs: 12.015299515s ago: executing program 4 (id=1544): openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fd\x00') r1 = memfd_create(&(0x7f0000000d80)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\x90\xf5\xbb\x1c\xac\xc7\xad\xdc\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bC\xd8\x1c\xe8\x9bYSp\xa5\xfd\ny\xdfS\xdbU\xf8l\xb5b\x83\x00\x00\x00\x00\xfc\x83\x18\xe46\x8a\x029\x19\x8fjC\xce\xa7S\x81\xd5\xda\x84\xdf\xe3A_\x05XCk\x1d\x1cC\x97r\x93\xd6t\x81b\xc7x\xab\xa2\xf0\av\x88\x01\x92\xeaF\xa9!\xfc\x1c\xbf7q\xcf\xed&\x96\xa6\x1c_\xff\xb4\x00X\x1b\xedw\xc1\x00\x00\x00\x00\xe0T\x1f\xbc\x85\xd1Z\xa9\x01Z\xc2\xb0\f\x9a\x16\xa5?\xf74\x88\xeez@)&\xb5\a\xc1\v\xe7\xdf\x80\xe4\x9c\xf5f\x94jC\xb1\xcfh\xc5g\x02\xc6 U\xe5\xcea\x88\xee\x0f\xf57*\xb3\xe8iWTav\xff\xd9\xb0C\x1e\xbe\x97\xc8$-\x8d)\xe8\\\x8e;I\xde\x8a\x8e\x0fq\x06\xee\xb9\xc1\xf1)\xa0\xd9T\xec\x8b\x85I\x87OZ\xd8\"4\x87\xb1\xed?:\x84S\xb9\xbf\xab#\xd0N\x8f\x1ey7\x9286p\x10uZ\xf0', 0x0) write(r1, &(0x7f0000000100)="6963260043ea488e29b6790eba8ac05bb965f95d224671c706cd90ba406d59a595ad6f0000200000f8bf54da8ac0d98c29f0de00"/67, 0xfffffffffffffd40) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) readlinkat(r0, &(0x7f0000000040)='./file1\x00', &(0x7f00000021c0)=""/102372, 0x18fe4) 11.696029872s ago: executing program 4 (id=1547): mlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000000640)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) r3 = dup(r2) r4 = socket$l2tp6(0xa, 0x2, 0x73) syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa1908004500006a76495d1400650000003a9078ac1e0001e000000180004e21009c907801000000040000004d69da731167d7d966ee21faaa03eed2fcd184b06096ac72a35bd79f33085cff8ab5c889a4e6354fcc0c08cefbf99d664efd3c8a05826e25c21d7545a95d84b968216436f9dfd65c9419725422b56d4f62c6fb8b65969e02ca79afa485fa585694f18c7cdd24aa7d1706404e62"], 0x0) r5 = socket(0x11, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r5, &(0x7f0000000180)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r5, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141430e0000003808a8972bd0b72e41082b1a3d206"], 0xdd12}, {&(0x7f00000077c0)=ANY=[@ANYBLOB="102300003f0000032abd7000fbdbdf250c00e0000500000000000000a500708028dbdd61738effa992938bd9dc71b57a608d5c2d9bd8e132dcf65808346eec4fdedfb27da54ca8c14322391f46b76db6252aa7377ecb21792a88b0dfb7dbf692f335478f7f55e6713ffdf93e723df677b7e1d41af928f507fc39fb97e4b407cd5a5d0cb5fac952c24526a77bf814268dde4a89c0642ab6fce5040039800400b2800400c58004002e800400da800c003900ffffffff0000000008001900", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="08161ddda7e0ad7430b76f0160a501ef35f11ba8e6210601cc578cbd01ea05dab2c5e904232d4c3199d80278164f16def6113030bffc3c7fe5f7c1e4bef4c19a82fa56ddd39a7dba120a4cdb9c9ca73a5f79e4e37e627eeb568f432a1a7bc0ebf502d8b8fd9fc8fcdf27a79082540cf6fc13490d12d66e7bdeafd4678db33b19f90ce1fc7c738bd7f8cbd5f6fdfddab16fa4c1edf702bfc78de2bcf362c3b7d6ca08e3d82b26123fad5eb28e3d722f4af3fdd15decd44749782ab272e72492c9fd8fb529c4273724750d3bb87b782b4b93cdc238f184590aeaf02d966baf9634b6122393a8b60d97c565d6e0f09e46087ec56b60ca2904c735f59be99fb5475d29761c4391d0636a475ed810927cf2973ecf5c18307ef4aca3772a72fe8b20b98340e42f3aa47d110a8e37866863f3561ee61e294fc9324d24847301689a17875518137547571ac0a2238a98f757c71760e8f05ea6313d29e4aa9b8f38b71a4997cd2c2c8c336227294760b289a47366f03b44b65fa43cc38482393dc2b323c4251ef19c4b51155614801d444319b42dda4dfc7113a41a3d58b959cb9d8f8da27dc5f2a15314008800fe8000000000000000000000000000250000006291067328dc6779bd2cd875f3e057d4200cc31995df95c3d1430ca4116dc32577cbc8894d24c98c559f8322d1e2f9963c7b47973c3a2aeabedd012a80b0b016ba424e", @ANYRES32=r5], 0x2310}], 0x2}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0x238, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@local, @mcast2, [0xff, 0x0, 0xffffff00, 0xff000000], [0xff000000, 0xffffffff, 0xff, 0xff000000], 'vlan0\x00', 'veth0_to_batadv\x00', {}, {}, 0x32, 0x94, 0x3, 0x4}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x20, 'ERROR\x00', 0x0, "094093b37cd589be20f97bbb709e46cef75dcfb9482a06d80cc259379472"}}, {{@ipv6={@mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xffffff00, 0xffffff, 0xff], [0xff000000, 0xff000000, 0x0, 0xff], 'syz_tun\x00', 'bond0\x00', {}, {}, 0x2c, 0x6, 0x3, 0x22}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) r9 = io_uring_setup(0x67d5, &(0x7f0000000080)={0x0, 0xc95e}) ioctl$RTC_UIE_OFF(r3, 0x7004) io_uring_register$IORING_REGISTER_BUFFERS(r9, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) sendmmsg(r3, &(0x7f0000007780)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003f80)=ANY=[@ANYBLOB="300000000000000014dfff00c7030000ef28bf01f87169db6d77dc5285868a4374ca046ed75be815c70000000000000058000000000000000c0100000000000008928c55b38ee583a1be2433042c93e46024a5a237c604f6d6e9b0aa0478d364afc9482528ad774cc131901578a7550378b9dc2100"/136], 0x88}}], 0x1, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f00000004c0)="74ab4564fdc88d613c176d380fa322a292dc777a31bfa24802d221ec200f34d6de3f056d776e819689d93b0ff7f5b82382bd1ef23a768f9fab0b96d610d6020b3a43cfe0d740cb22117619244d0677e16feee645ad2c948097f19897e89b7bcb6b0bd828fe62ca743dc6b8754de90aea3e1fa96a7f8cfb73e7addfa9743c614fb7e2997f304a8ae472e23fca61a06610ed1354636ce70f9d245da049228be37b0b504981ed0dcab91cb58e9b8eab6579304b2a54d3fe33a89f851b3c4d5153eb5488406272752389d9c9eb7c46d798c161ea07c28d8486ea771ba397cb56b8763afd7cebcb06"}, 0x20) socket$pppoe(0x18, 0x1, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x2a, 0x0, 0x0, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r10, 0x3ba0, &(0x7f0000000280)={0x48, 0x1, 0x0, 0x0, 0x6}) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r8, 0x4068aea3, &(0x7f0000000400)={0xed, 0x0, 0x90}) ioctl$KVM_RUN(r8, 0xae80, 0x0) 9.704305429s ago: executing program 1 (id=1550): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0xdc9, 0x2, 0x5, 0x722, 0x13, 0x7, 0x7f, 0x3f, 0xb763599953cb091d, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) (fail_nth: 1) 8.970498234s ago: executing program 3 (id=1553): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x80, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mknod(&(0x7f00000000c0)='./file1/file3\x00', 0xc000, 0x81b) r3 = landlock_create_ruleset(&(0x7f0000000440)={0x7511, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000021c0)='./file1/file3\x00', 0x2) socket$inet6(0x10, 0x80000, 0x3) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000001c0)=@mmap={0x0, 0x1, 0x4, 0x20, 0x0, {0x77359400}, {0x4, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x291d}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000100)=0x1) r5 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)=@newtfilter={0x24, 0x2c, 0xd2b, 0x10000, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x2d5e9a624ed3e1fd}, {0xf}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x893}, 0x24040084) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)="17", 0x1}], 0x1}}], 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) 8.859498727s ago: executing program 1 (id=1554): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socket$l2tp(0x2, 0x2, 0x73) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffedb}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x0, 0x0, 0xb44, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x60ef80, 0x0) socket$inet(0x2, 0x2, 0x6) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000001c0)={0x9, 0x408000, {0xffffffffffffffff}, {0xffffffffffffffff}, 0x800}) ioctl$TIOCSPGRP(r4, 0x5410, &(0x7f0000000200)=r5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r6, 0xc05c6104, &(0x7f00000000c0)={'\x00', 0x0, 0x5, 0x3, 0x2a28, 0x0, "f759ca14860e00", '\x00', "03000500", "fc599184", ["8bada940ed86af0a00", "c2a4a110cfc1bac26ef76ef7", '\x00', "00113a071fa0fcd9c500"]}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r7) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r7, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmsg$inet6(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)='D', 0x1}], 0x10000000000001d1}, 0x4040845) socket$inet_tcp(0x2, 0x1, 0x0) 8.09267271s ago: executing program 4 (id=1556): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20040051}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x40050}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000280)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x2e, 0x28, 0x65, 0x0, 0x2, 0x6, 0x0, @private=0xa010102, @broadcast}, {{0x4e24, 0x4e20, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffe, 0x0, 0x57}}}}}}, 0x0) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r4, @ANYRES8=r0], 0x3}}, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="280b7b6faf7596bdbae7e5421fc600087e007927bbcdcded44a9f5b0bcd44685971b14bc034c7e5f7af6d56840d6862b6c1404a09d092f3ad76504c4f8f96625136aa03efea3fa060c391b1ea5240de797cbdd55591c75ba214b2c9482118bcfdbf4b5effd51e6fd82f27f1b3583758ab7b7f5425c802935a022c60cc5875327217dc4a9b5f398e057ebd10bc3be7d242373ace55d0f9a745c7ed103519e7b14e51339d1bc7c1f85a8670b9debe68268df54c91008d40a23444680f2df178f5f67"], 0x0, 0x0, 0x0) read$FUSE(r5, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2058) write$FUSE_LSEEK(r5, &(0x7f00000021c0)={0x18, 0x0, r6, {0x7}}, 0x18) chown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x10d00, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100000ca3af407b5ee20000000020000000337f9663e9598cdf5061f902120001000000000904000000a6015600"], 0x0) 7.550138876s ago: executing program 2 (id=1559): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x103042, 0x0) pwritev2(r2, 0x0, 0x0, 0x6, 0x1000, 0xff01) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x8000, 0x8000, 0x2, 0x3, {{0xf, 0x4, 0x3, 0x7, 0x3c, 0x68, 0x0, 0xd, 0x29, 0x0, @multicast2, @private=0xa010102, {[@timestamp={0x44, 0x4, 0xca, 0x0, 0x8}, @timestamp_addr={0x44, 0x24, 0xb1, 0x1, 0x8, [{@broadcast, 0x7}, {@local, 0x6}, {@local, 0x9}, {@loopback, 0x4}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0xe, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, @fallback=0x1}, 0x94) r5 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, 0x0, 0x0) socket$kcm(0x2, 0x1000000000000002, 0x0) unshare(0x42000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) 5.939438256s ago: executing program 1 (id=1561): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000007c0)={0xa, 0x2, 0x0, @empty, 0x80000001}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) (async) sendto$inet6(r1, 0x0, 0x0, 0x4040045, &(0x7f0000000340)={0xa, 0x2, 0x0, @private2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e25, @rand_addr=0x64010101}}, 0x0, 0x0, 0x3f, 0x0, "10baa70a93289349d889de25b87376f64276337642b890d33cb5b59204005b23cf19402835fee1b38744eeed279d00008b6d9b3d796d9da44a370dfd6700"}, 0xd8) (async) r2 = dup(r1) write$FUSE_INIT(r2, 0x0, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$ITER_CREATE(0x21, &(0x7f00000022c0), 0x8) (async) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000080)={@empty}, 0x14) (async) sendmsg$IPSET_CMD_TYPE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x20000001) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) (async) r4 = dup(r1) ioctl$UI_DEV_CREATE(r4, 0x5501) (async) r5 = syz_io_uring_setup(0x76d9, &(0x7f0000000440)={0x0, 0xec25, 0x400, 0x10041, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f0000000a40)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) (async) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x1) (async) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x5, 0x722, 0x13, 0x7, 0x7f, 0x3a, 0xb763599953cb091d, {0x8, 0x6fd8e84b}, 0x3, 0xed}}) openat$audio1(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000280)=ANY=[@ANYRES32=r8, @ANYRES16=r0, @ANYRES8=r2, @ANYRES16=r1, @ANYRES32=r9], 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)=ANY=[@ANYBLOB="10000000140001002abd7001fedbdf25"], 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x4040) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r11, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="595300000000000000086b0000000c009900020000007200000010001d800c2f00800500070000000000"], 0x30}}, 0x24000000) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB='h\a\x00\x00', @ANYRES16=r10, @ANYRESOCT], 0x768}, 0x1, 0x0, 0x0, 0x1}, 0x4004010) 5.698233007s ago: executing program 2 (id=1562): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mknod(&(0x7f00000000c0)='./file1/file3\x00', 0xc000, 0x81b) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100), 0x18002, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7}}, {@blksize={'blksize', 0x3d, 0x200}}], [{@subj_user={'subj_user', 0x3d, '-('}}, {@obj_user={'obj_user', 0x3d, '-&'}}, {@uid_lt={'uid<', 0xee01}}, {@dont_appraise}, {@uid_eq={'uid', 0x3d, r1}}]}}) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0xab, @empty, 0x1}, 0x1c) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000ec0)={'filter\x00', 0xb001, 0x4, 0x3c8, 0x110, 0x1f8, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@multicast2, @local, 0xff, 0xff000000, 0x3, 0x9, {@mac=@remote, {[0xff, 0xff, 0xff, 0x0, 0xff]}}, {@mac=@local, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x1, 0xf7fd, 0x5, 0x7, 0x7, 0xfff, 'tunl0\x00', 'hsr0\x00', {}, {}, 0x0, 0x10a}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @dev={0xac, 0x14, 0x14, 0x3a}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0x0, 0x1e03}}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x8de, 0x400}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x0, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, [@CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4008095}, 0x24040010) r3 = landlock_create_ruleset(&(0x7f0000000440)={0x7511, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000021c0)='./file1/file3\x00', 0x2) 5.565146762s ago: executing program 2 (id=1563): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) io_setup(0xfff, &(0x7f0000000100)=0x0) io_submit(r1, 0x3, &(0x7f0000000900)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x5, r0, &(0x7f0000000180)='f', 0x1, 0x7}, 0x0, 0x0]) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="4dc07f947163300c", 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000003c0)={0xc}) ioctl$IOMMU_DESTROY$stdev(r5, 0x3b80, &(0x7f00000001c0)={0x8}) sendmmsg$inet(r4, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="4b97bf80a25405650000000000000000000000000000008a1eeae00747be9578b6739cc92a6e5ed7f4e20ac600dee17d70eb20bdff91e0df3942388e854ff0b0f9e28f1b158b1db52c6b588d6b0bede9e163c6ed69ef263249ecaa9d3bcf6d0a20df755e79f1026141c5cfa136dd078e9d56980cf235eec97a74", 0x7a}, {&(0x7f0000000180)="e3", 0x1}, {&(0x7f0000000040)="d8fa34", 0x3}], 0x3}}], 0x1, 0x4044894) connect$inet6(r2, &(0x7f0000000340)={0xa, 0xfffe, 0x8000000, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000b40)='./file1\x00', 0x0, 0x100, 0x12345}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r6, 0x4) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r7, 0x84, 0x4, &(0x7f0000000d80)=0x101, 0x4) sendto$inet6(r7, &(0x7f0000000000)='X', 0x1, 0x4000000, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r8 = syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0xfe15, 0x10, 0x0, 0x30f}, &(0x7f00000000c0)=0x0, &(0x7f0000000540)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x30, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x46, 0x15, 0xbd, 0x40, 0x1a0a, 0x102, 0xcde9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcd, 0x0, 0x0, 0x33, 0x11, 0xa0}}]}}]}}, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r3, {0x6}}, './file1\x00'}) io_uring_enter(r8, 0x47bc, 0x0, 0x21, 0x0, 0x0) 5.436983258s ago: executing program 3 (id=1564): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x40281, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) (async) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0800430500000f"], 0xffbf) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 64) r3 = openat$kvm(0xffffff9c, &(0x7f0000000440), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) (async) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x40, @dev}, 0x2}}, 0x2e) (async, rerun: 32) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async, rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r2, 0x2e) 5.099605087s ago: executing program 3 (id=1565): syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x40400) r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() process_vm_readv(r1, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000600)=""/166, 0xa6}, {&(0x7f00000006c0)=""/209}], 0x2, &(0x7f0000000040)=[{0xffffffffffffffff}, {&(0x7f0000000140)=""/88, 0xbc}], 0x2, 0x0) sched_setattr(r1, &(0x7f0000000040)={0x38, 0x0, 0x5, 0x5, 0x6, 0x3, 0x3, 0x5, 0xb, 0xffff}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/handlers\x00', 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) statx(r2, 0x0, 0x1000, 0xcf3433d97aab2983, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x10, 0x1418, 0x1}, 0x10}}, 0x0) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x1, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="18200000030000000000000003000000950000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x8, 0xff9, &(0x7f0000001840)=""/4089, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x28}, 0x94) 4.901832356s ago: executing program 3 (id=1566): mlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000000640)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) r3 = dup(r2) r4 = socket$l2tp6(0xa, 0x2, 0x73) syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa1908004500006a76495d1400650000003a9078ac1e0001e000000180004e21009c907801000000040000004d69da731167d7d966ee21faaa03eed2fcd184b06096ac72a35bd79f33085cff8ab5c889a4e6354fcc0c08cefbf99d664efd3c8a05826e25c21d7545a95d84b968216436f9dfd65c9419725422b56d4f62c6fb8b65969e02ca79afa485fa585694f18c7cdd24aa7d1706404e62"], 0x0) r5 = socket(0x11, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r5, &(0x7f0000000180)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r5, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141430e0000003808a8972bd0b72e41082b1a3d206"], 0xdd12}, {&(0x7f00000077c0)=ANY=[@ANYBLOB="102300003f0000032abd7000fbdbdf250c00e0000500000000000000a500708028dbdd61738effa992938bd9dc71b57a608d5c2d9bd8e132dcf65808346eec4fdedfb27da54ca8c14322391f46b76db6252aa7377ecb21792a88b0dfb7dbf692f335478f7f55e6713ffdf93e723df677b7e1d41af928f507fc39fb97e4b407cd5a5d0cb5fac952c24526a77bf814268dde4a89c0642ab6fce5040039800400b2800400c58004002e800400da800c003900ffffffff0000000008001900", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="08161ddda7e0ad7430b76f0160a501ef35f11ba8e6210601cc578cbd01ea05dab2c5e904232d4c3199d80278164f16def6113030bffc3c7fe5f7c1e4bef4c19a82fa56ddd39a7dba120a4cdb9c9ca73a5f79e4e37e627eeb568f432a1a7bc0ebf502d8b8fd9fc8fcdf27a79082540cf6fc13490d12d66e7bdeafd4678db33b19f90ce1fc7c738bd7f8cbd5f6fdfddab16fa4c1edf702bfc78de2bcf362c3b7d6ca08e3d82b26123fad5eb28e3d722f4af3fdd15decd44749782ab272e72492c9fd8fb529c4273724750d3bb87b782b4b93cdc238f184590aeaf02d966baf9634b6122393a8b60d97c565d6e0f09e46087ec56b60ca2904c735f59be99fb5475d29761c4391d0636a475ed810927cf2973ecf5c18307ef4aca3772a72fe8b20b98340e42f3aa47d110a8e37866863f3561ee61e294fc9324d24847301689a17875518137547571ac0a2238a98f757c71760e8f05ea6313d29e4aa9b8f38b71a4997cd2c2c8c336227294760b289a47366f03b44b65fa43cc38482393dc2b323c4251ef19c4b51155614801d444319b42dda4dfc7113a41a3d58b959cb9d8f8da27dc5f2a15314008800fe8000000000000000000000000000250000006291067328dc6779bd2cd875f3e057d4200cc31995df95c3d1430ca4116dc32577cbc8894d24c98c559f8322d1e2f9963c7b47973c3a2aeabedd012a80b0b016ba424e", @ANYRES32=r5], 0x2310}], 0x2}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0x238, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@local, @mcast2, [0xff, 0x0, 0xffffff00, 0xff000000], [0xff000000, 0xffffffff, 0xff, 0xff000000], 'vlan0\x00', 'veth0_to_batadv\x00', {}, {}, 0x32, 0x94, 0x3, 0x4}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x20, 'ERROR\x00', 0x0, "094093b37cd589be20f97bbb709e46cef75dcfb9482a06d80cc259379472"}}, {{@ipv6={@mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xffffff00, 0xffffff, 0xff], [0xff000000, 0xff000000, 0x0, 0xff], 'syz_tun\x00', 'bond0\x00', {}, {}, 0x2c, 0x6, 0x3, 0x22}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) r9 = io_uring_setup(0x67d5, &(0x7f0000000080)={0x0, 0xc95e}) ioctl$RTC_UIE_OFF(r3, 0x7004) io_uring_register$IORING_REGISTER_BUFFERS(r9, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) sendmmsg(r3, &(0x7f0000007780)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003f80)=ANY=[@ANYBLOB="300000000000000014dfff00c7030000ef28bf01f87169db6d77dc5285868a4374ca046ed75be815c70000000000000058000000000000000c0100000000000008928c55b38ee583a1be2433042c93e46024a5a237c604f6d6e9b0aa0478d364afc9482528ad774cc131901578a7550378b9dc2100"/136], 0x88}}], 0x1, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f00000004c0)="74ab4564fdc88d613c176d380fa322a292dc777a31bfa24802d221ec200f34d6de3f056d776e819689d93b0ff7f5b82382bd1ef23a768f9fab0b96d610d6020b3a43cfe0d740cb22117619244d0677e16feee645ad2c948097f19897e89b7bcb6b0bd828fe62ca743dc6b8754de90aea3e1fa96a7f8cfb73e7addfa9743c614fb7e2997f304a8ae472e23fca61a06610ed1354636ce70f9d245da049228be37b0b504981ed0dcab91cb58e9b8eab6579304b2a54d3fe33a89f851b3c4d5153eb5488406272752389d9c9eb7c46d798c161ea07c28d8486ea771ba397cb56b8763afd7cebcb06"}, 0x20) socket$pppoe(0x18, 0x1, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x2a, 0x0, 0x0, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r10, 0x3ba0, &(0x7f0000000280)={0x48, 0x1, 0x0, 0x0, 0x6}) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r8, 0x4068aea3, &(0x7f0000000400)={0xed, 0x0, 0x90}) ioctl$KVM_RUN(r8, 0xae80, 0x0) 4.695318158s ago: executing program 4 (id=1567): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x1000, 0x2}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000280)={0x1}) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000021c0)=0x1, 0x4) setsockopt(r0, 0x1, 0x10000000000009, &(0x7f00000000c0)="f5c89e1e", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f0000000040)=0x3e, 0x4) syz_io_uring_setup(0x2dfd, &(0x7f0000000100)={0x0, 0xb9ca, 0x400, 0x1, 0x2bb}, &(0x7f0000000000), &(0x7f0000000080)) connect$inet6(r0, &(0x7f0000000400)={0xa, 0x4e22, 0x5, @loopback, 0x6}, 0x1c) r5 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r5, 0x6b, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 4.399421176s ago: executing program 4 (id=1568): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000000)) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x48, &(0x7f0000000300)=ANY=[@ANYBLOB='n'], 0x8) (async, rerun: 64) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x6, @local, 0x3ff}, 0x1c) (async, rerun: 64) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000001c0)) (async) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000040)=0xc) (async) ioctl$SNDCTL_DSP_POST(r2, 0x5008, 0x0) (async, rerun: 64) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000640)=0x10) (rerun: 64) close(r2) 4.100157909s ago: executing program 0 (id=1570): socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) set_mempolicy(0x2, 0x0, 0xf5) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000019540)=[{{&(0x7f0000019100)=@file={0x9ffb0f5d0f37f556, './file0\x00'}, 0x6e, &(0x7f0000019380)=[{&(0x7f0000019180)="2443b6c3a94f039961cbbeefab642660f45e1600a980309823c3b729b25dfce5ac347ee742d20dce869302f84c0bd2809b78b0532a2b50e89de65e1edbf7fa3e2d1522004ca39af8e8701f1fb8dd8edf2dd890b12e69f75c9a58dafa6bcc29695754f003fefa7877391778f0c9ac9a97d7d6ff44bae58bdd0c077f98141bd32d7ee6eca069b27dd8f637b570f24434b4c28b05c79f3c145e93bf1f4c9eca24d5549bd48e637c4ae0d1fb38b6ba322fd551c65718afbbb5369f9a4f092823834f2f201eaed0e9e5fd", 0xc8}, {&(0x7f0000019280)="b6d68af82bf5f06a4230dfa05da1a2a086aa4475d75513c378b34b91833056353be87ca767d7f7d936efd2913866549806db636b259f387055e87f13f106c25627d2857bee8fc79cd9a3bbc92f90929ffadc56a7072edf15e910736d2a76018f801f751404a03569480c25b3f9b5f2698b81a5e5b5ea", 0x76}, {&(0x7f0000019300)="639a3e4c91770820c5c6ebc204cbf191654d9fa66645fa9d27671319fddc92afb7ca37d09a08128922188778a4b8bccd64116d59d1ebffefe6ca5945b319f297cdddb19eece20e8a5629ca97eff43c7fe6a3d05e5239b0a4dc8b", 0x5a}], 0x3, &(0x7f0000019500)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x40, 0x20000004}}], 0x1, 0x8800) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x8000000000000001, 0x0, 0x1, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x6, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) (async) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) syz_open_dev$sndctrl(&(0x7f0000000580), 0x2, 0x141240) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x64, 0x4, 0x3b0, 0xffffffff, 0x128, 0x210, 0x210, 0xffffffff, 0xffffffff, 0x2e0, 0x2e0, 0x2e0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@socket1={{0x28, 'socket\x00', 0x3}}, @common=@ah={{0x30}, {[], 0x0, 0x0, 0x5}}]}, @REJECT={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, [], [], 'wlan0\x00', 'wg0\x00'}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, [], [], 'wg2\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x410) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYRES64], 0x74}, 0x1, 0x0, 0x0, 0x48000}, 0x28000) (async) recvmmsg(r4, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001d80)=""/166, 0xa6}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x1}], 0x1, 0x40002122, 0x0) (async) socket(0x2, 0x80805, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r7 = io_uring_setup(0xaae, &(0x7f0000019080)={0x0, 0xdf4, 0x80, 0x5, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) (async) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) (async) writev(r6, &(0x7f00000194c0)=[{&(0x7f0000019580)="1a4a4f713ee4edb25663744bfd63b91662a91b4bf203d9a1202f192911d1318ae62a668b0fd130d87928a8a650dc6e01fef2d0c48adccfe98ed9fcb5ce78f8e62a254915321e973e0aeecc51ddb584e2408b15ab75a39b4dc3527de49a6b42e30bd41bf04be19b12a884b71ee7275fed13bf235b737c06b48d0889bc8b649ace0fcb529fd739980413452d7e9fa34fe77458b50462bc826ef559d109932a33a466af23c59f5776a43cef05dcae43e37c81d43ca0ffba663eb6af5d2c2d27958f0b75c0e1cd47eb2405cdb7fb4be67c76e2f5bf69a2d26017b5ca54644ae4dcf8e6b7e7f3b7dbfec4e7c9b293ec2699cee81c0564ccf66e29adbaf90a65df5ca19a3fa61bf55a4cbfcbf9c1f0c15157ed7d3ed0fc506dc3316ff57f3017514a86e92dae19785ecc73bfbe02cc3f49bd65f3e51b5efa7d14c4ee4d03de150a6d032e55847042556eb5b408ad96e2ee3fe5ef3e205e81ee9955647179151566f38c3db8214db71fafd10033599183c240d1ce8247eceae0db3cbceeb273bd1e6e1cd707555fb6049acc9b9a544b9e42eeac7b02a3f3cc3736900a9b56e1f0ba0e9530886060c6c3b9b0ba161b71060dfb038983bf82afe0c117b945c4cbb544ea5039e519e64294ff0714b24176bf909068d9869bb6da8c324ba71d720732ba546d5c5da02ae90df0de3fcf6ca3d20ddb8fdd603c77a8d8225067a3263bfebe8c654356cc815993b81a151acd1fec1f9a703a8e0f966256a5af4eb3311775214173d3944f08e916e46b0f27077262b2b389a6b2099f8c2f4f8146e41bceabc89d6a012a1d285c30bfdd92bdf96d76cd7a0cec4bf9f299d5fbd41d1b0170582f0c59303faf5f436fa0f0b8d9bc7678cf7c56355903145091c0d0011a5d6b62b54d26fc350d57be1ab855656595034f2b1f6c0ea7ccdf3c86ee29a5985023c4972819d1c418d5116476407ed7ed3497749c4f204534d60461117d0337fab6dd48f006d7a4740a644bf36a9c7064abf21531fe105c418d6248498d109e6fccda5a5ea0332b2673ef72904690d59b11ab81a1c9c5116103e76b7be63710d9ffcd06b1413f0025dcce1e7d5e406c7fd47ee23a0e397ff7cc3cc0d26ec97346fb4682afa5e5fb6fddde4e7aaa7d06ae7cfdf197236893fdf2da4a2d9a36638b52573eab9a418da6c07a8bf4364bf87807f544968587078ee91fca5a6c978cc85e4cd36f154c9366ee4de595c6cdde0bc2c2af1d8998003b00cc06a10fe53809d3c7c3566684e3737c721d04808f04e69db51f1a400c179308d4d3dfa7a26843aa0ebc2f4ec193180e35ab3ba231532f3212037c1857f22399c3abbadab1f8ec039a8b01da074192ecf5b33312b05dc87e781d1abf891f915eea4087b0594fe321c96031090565bcf792fd15e42865ea0d0ec806daa2d61ef3aa25029ae2e7b68ccbb917d152267128c7a01c35fd5282df0cc9093ac4fe83d5bc903636a404373518693373f3526639613cc8e7210ae9068bd7ea882c81b14a69109a22c7ef0de037525ef38009bde6ffcb286d6aa2075e5f32cd89fa7e054e999cdc5cda713376c581aadadc5489e87cd7e46f8665abb47ee743aaa35c2ac945f395e479fff680e30323f11ee8092416b172b036edab6b867b4dfc198d8200acc29f4b64aad29265528a1c6a2940f03993b071659cd5ba7888c91b99ba86b1e4307f58be32c387611e5dad5706516609639b72b46e6f65d316e136340b56e37eb683352c0dc82a33c64417f497764f79a395ec16ee52334de8cd40b1d144f97d8026bb7d7888aea537e1d89fbaac2f5720668172cf1b4e016808381787fc7589d81d206df8085f27fdd0e1df3908e820b0fad2a608b02a4b496743d034e0c982aacad88590d6c360ea771eb453f4a1bdf9572bf76300b862d81c2404e20ca4527bb25f7e43a1d46410740c8a205ad46d16fb1cc85a45b258008fe359d420c5a84f46aee2cd60f2372e8d29a513390917bf9d12ea287bf4727b268b841bdbe46e444ba814c23f03a932158e8abf4efc8ba0f9ea43dcb2c7d6fcd81123f8125fbb930048fe2dfa228ee79e15af00a9d3977af74d36caf586367ea8f5ae93071e6daa7381abbd413728297d6519a787c8008336133913aa7e4a4d06502e889f4b22584b38555a9861f07c368ed3c9df79a4b922580eacaa9ab2225038cac2546fdb11fb177a5ed3b6d90242107aaa73f229bdeace7d3576817c42bd59007097f329a86153218a29798b7d536ca88d2c72c6988ef23e6f9ee58c67c419f5d2469ec7c0943912aeefcc7279aa6e4b760ad3456fb0b0b20022ae9e6e4a390b0df61764a34d9f21008f5e1b8c748236c00d8101703667b8cbd3ebc922b7b9ab575da219b2e26502f708b246d16ea7944202dbaf97b1b64a1b209e3577bb100d900de89967fcd35c7753784981d6b565ade08f37a00387ada9e27909d2914271dacaeec62c5e714c2d4ad8895970c6deb7b81dcfdf5aaa6e5629c8b2752696f29ba7338a9fce9bbd0ba510d0d46a707a6f78d9ded3cab0d42b1410eab998d049597ac3aa2411e18ad2330cb90fcfa73f1b295dd37684af86e9c3a6cdba38771bd08df2a8adf217dc4660a948c159b2f077bf1196bf94774173bd776258bd043eec87aaf2ed530c6ac61d431d6d3f63d3a1029ebf2d4106082efcf1347bb1c1f548ec94ac638f1da8bb604aac6e4f297213f616c85e75f4a7d12bdba882cf44b71689902bcb49bbf78e8f34d641416b0c9ff91a9b70ddd9c803b06b8b62f6738aa1e6545662f72ff9ecf085afaa83453167647aff9584c52da229ac78d8643089857289de7d4ee6540e9c1aa796fc3755abe3e2ae643f4899c821bd53b0e5f4e2b99b27621a886f6cae59d3fac804b155419833d4838a127870d37c0ca9e58d698dce336ddf1bc8decf4da2f788ce48d1f22d113da17148ab7f586a8b62057d3a4639970746f8306dc720ecd04a20511ea2988d75dfc02b2a86c5aaf74e12883a90c2e26ae2f7ead1dad4adf399e791ce1e662c63154662b81561d0656da609262811deb0bb45bb65dce4d5f3768b2b6b693a155297310d531e3ddd8c69c84f9909071fbe29b2967ed14bb758fbef77d2e4885028babe872b96741b9c9b5a363e533ec0da30aaef88b8cf22e435d141e995752cc40612a9301c9a8ff3f9e38e53277ec81e4c35a6c6bd004538ec5b9bf0970674f914e406b228fa663c5e50a78fb24dfd9490c94240a17b688fc2577936e4944bbe14d0d28a8c4d8f4ab5d911416329329bd057e68acbe81cfde25e4b3b4a1c06d37066c972c048577589ca40229be1f43e9c12be75f658e2c4fb28e334f264097762f06686968fd262f7e013edc6d6232d447a7e37cf97957f61be8cf7b369a1b53492cc15e6eabe678c6a30ea48e1105075f6d034eb211bdf3514e5255085e455346acba52983b1902beda6fcf85be3c244ae0e54b3c8859ee51cb8c7591b9edf53a1f40a3c48ad0f16002d645a8f7a3e7bc6294e49d99189dbff2ed841f1feed1b36b31e85a9039e96f6c68ad52922905324bb65906647fd422355a2493e47279340dd78f199a8c8073113b17927324043d0dc95415dd0a77dca5d4688cce96e716a9245f00d06cb8535e11b1d39eaadb543cabf7b11fc39cefa0a79a5de28c820968588b47860f56212e7d1add3fb832156bbd70fdaf0ee71c01fec057e90587ee4ab8696b3ac93a9ef0a9ccf19c623ffd15d15e069899b67a8365486faaaa7b757f2ee0b4ba33f65ef281ac6e7d780d0fc709b6289e24736d43b23185a1fb2c2bda1508d55ad7de4b24f2c5fe78d2b4d65d793c51554fcb17d0c499486d1c28370d894195ec0d3b06d5748893c8580d63d72cedfea3c46f7a7ce4bca86f29084de7e3eaf193fff2fe52556e91fa1b933d79b8f035b9d7a29c26230c4eb7cb9c26177daa36df3b0c692bd5faa69fd70d929bfafc3a8f1a3b77f04f83ac950ecfecafc72095df96b02b409b08448a7191861f34b1413f13b9cc71f77904afdf1c05f74e75a0a05f61d5c4e31f86efc74fec65c4388f9b14d51fd037fd722cd10682809e4d175174f3f184fd23902122022c0254d01fe426eea2326ef311bd7daf4d25cea6370b43f7479ea9a7db9957bfe9ee1bed62848869db02a7236ccba47e79a6f31e4bafe6c1277f6d7050c99bbc5803397a87019a8a6c8e74190685eef1bb4eb6e2298784bddc46bd320b8b4153d01a7a82bafdd21923d650ab22af1b913a35359b99e52c9b02791172ddbd7688654126a60cbf97414150b75dcce74d623fe7cc512b5ebc868cfbe5a8ba8aec068d0b62aa2280cd9cd7e59167a48485111cd34fcf871b807a3e5e35e87b507ccb32818454c9be6d56a318c4aa18236c250cb7f78f518b188326351f5a0b2da51157cc5044da108481972ff98703f9590b4db3e4edc31c1b97e64ae7ca70a6310e144bd4b41a21d95199c5ed89f2370838bb505165a07c9c8a4cc3e44281bc98d1ebf91d7fc5faa823a7ef29078a581b51184269537371daa988581d846324fdc9ea2717e0cd4a86f2d3163fb55956517a07006c94b5503c398b165b75b568c5ec079c9ccd8ac33e0f41319f1cdcb5f6b6d30f0b3f3cfee4311bb572bf289aac2b6843eb5e29ce5889dec4ba9724d8e9a2527a5a0c00d48de2763416a5d69f9c13bfb9142db67b19d46751953e15d6b31314164d08963fcbc4624c7e35200c81f8e849b13e635b7afae7231aee47a458baa3266c85e8c9a16ba90887669423c699aec5a82d39292db4b949316e01d6c9cb38c5668724152cedbd6d2aa026daf6eba748a02f7cdd47938835de946f7f762dbddb7c6a83b0d1f49224ce320463d88e47f001a294c43668fc443cf8f250d89ed92a6ece20155c7df88b0eafe741a7f7c6ec7af8fe8856ea79c0459fb1442b704a78742f32324e7877d049dfe68b687d7c5be08c88ec3eee6bfa096d2333181311c632c3c8ceba759deae96aa62465e0a4eeec6db3c558cf33b2e8ef7acd1925c25b52270e108f7ff94c450b60b09531a58bf4e11d9b5efa60fa5d2d3bc581575276ab4da53b28e61b148390b9573a833d9e9907f67848ffaab2f7a0d44b9dcc2e2dd54b139fe68d7408a5e8abce2cce0bd9cc7945701af2cc5066444de185f6717b16d37bf5bfbab09ee1ebe8fddd46c69b7f9907e1a1f4d34ed4cf24abec13bee708273afd5785e1ce1e49e4dc3aa8af42204628f107850d56dee6656098e5364f7f532dbd575c9e0b9e48169772205b297f48dea496e3adf2020299305cf5bbbbca3e051a204d35619ab635e2423fcc1f3c9e511b83e84e655a3c06feb413cdddb190f925668bb2503c9b29bc04f40c3f45f8ce60e26264b6e263c2c1858e231e326fef8e6ee12751374c147897035cea3c1f71950352962901ae51b23a9c421220aa3149d4da00bc600295f1b198e3ff342610d33a6a27aa315046b01e0d9238cdc606eaa964a52d72103b80670600198c0f196c19b5522eafcac195608f4855e5cd4dd3528126d3063ce3d9f545bf9598cd4e95ca270c45dd07c2ac00e15d139405c8d3b61441418404cbb6a4d46d70157b82b5f84eb8fcbc65ee4d96edcf1bd8190fda5cb08d84bd730a2bfa37aaee6cb88c5b620095cf79a01ee062aae5c1a0a35dfb924450c89228ed902bf43e6bdb370b5cada8730405fa35bc00000b4889b04f2300261d0c975e9fef7d0c03df7056552f8e52cfef593efbf25ade2e7afd760e1aeedaed7366d9b56ac94c7aae0730f84678e8a16ce", 0x1000}, {&(0x7f00000193c0)="ff8e98", 0x3}, {&(0x7f000001a600)="e51b01d8b22dff8e829ba2fb6f8229eb986703840c41a199345af85f01a025074f834dc1c4b188e04c36f16e30ce4db58d8550114e784bca0b2ec8ea6718b5fb9dd178e1ceced54a6395162408a1fd8ec02f1972a008b56c7160b3d46f368accdc37b84003202752157bc5ae33e08778be53b8fe6966efd3f4e8fe62b9a7e11d350d738f258406972d2f232cb290b69436c475ee568245b0ba2b79b851d891acd2910f3d", 0xa4}, {&(0x7f000001a580)="0227bb2c1c1e8ae4c0612af87bb529dfc273936655ab8850ff065932597b6d4d9a3eadb3693063462e29f76815dead67054af423b8ea2b156b81d7cebe30ccf38c4b34b8332ae13bc7", 0x49}], 0x4) 3.835168725s ago: executing program 0 (id=1571): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000040)={0xa, @pix_mp={0x3, 0x708, 0x49433553, 0x4, 0x3, [{0x6, 0x1}, {0x0, 0x75f7eb8a}, {0x0, 0x9ea9}, {0x6, 0xffffffff}, {0xffffffdf, 0xffffffff}, {0x5}, {0xe5a9, 0x5}, {0x3e92, 0x3}], 0x1f, 0x3, 0x8, 0x0, 0x3}}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@newtfilter={0x490, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_bpf={{0x8}, {0x464, 0x2, [@TCA_BPF_ACT={0x41c, 0x1, [@m_bpf={0xa0, 0x8, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8, 0x5, r0}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x7f, 0x88, 0x7, 0x2}, {0xc232, 0xfe, 0x1, 0xfffffff7}, {0x40, 0x2, 0x54, 0xf7ba}, {0x2, 0x9, 0xb, 0x9af8}, {0x3, 0x40, 0x4, 0x4}, {0x8, 0x1, 0x3, 0x4}, {0x1, 0x2, 0x7, 0x6}]}, @TCA_ACT_BPF_FD={0x8, 0x5, r3}]}, {0x29, 0x6, "66fbdd594b36c7f23c319172c27931a35afba812dc5608ee185c9ffbc6d71fc2a37030288a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_skbmod={0x16c, 0x10, 0x0, 0x0, {{0xb}, {0x6c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x7, 0x5, 0x3, 0x1, 0x3}, 0x2}}]}, {0xd7, 0x6, "e151a1960d2fae49bdf035b44576d6e3df9aa672b61dae3f1dd54a23eeebf3e08e33aed7448b64b6737362551eb8694a31b713db98e37eb7e2c97f6de617c7f33c255d57ed440ecb95749d564c8cf0e89628b4d424d975e0c0521d067b6167ad8ae1557bde675cbc5d2f998719a87beff4b9c2a913d0bce41a6301e8b826ae4a924d7a9f138bddfc7b915582e4e989a81844eb95972a4f0de3f498ad1b4419c38e962ffef5cce99919e783ac095bd16304ae3d68bfc0d206f7d131ef6074fae4a044d536b7d07324b094db9debfa2ca4c87cba"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_xt={0x118, 0x6, 0x0, 0x0, {{0x7}, {0xd8, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_TARG={0x2a, 0x6, {0xd91b, 'mangle\x00', 0x8, 0x4}}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x74e}, @TCA_IPT_INDEX={0x8, 0x3, 0x85a}, @TCA_IPT_TARG={0x36, 0x6, {0x6, 'raw\x00', 0x83, 0x109b, "e51e5487c94b3ed9bf2b2fb5"}}, @TCA_IPT_INDEX={0x8}]}, {0x1b, 0x6, "1198438d5b7b252c6044a5a93303d1ab90582ba1f124b9"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_vlan={0xf4, 0x12, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x2df}]}, {0xbd, 0x6, "d2194ddf1a41bb6dab11d9c1039933a223746ff7a7e6d5894edc6043565790cd951cba0fe4475f512c8694a3d5bafd7aa58b6e74b7ed82c38818b3b58fb8841058b6eea47f6bdf601927d1405ba3942e479d7962632d95f5bcad3f12bebc46f9f4583803fbf67afa41876275a94babb88db3449ecc96a221b6e68914600e8d3b71fa88506291918ca1131f200fc12a942a6ba9e6e44b7648def4167c0caef265d45743ccbc99f7fc53ce840ba6e37a348f7791fcb985cce74f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_OPS={{0x6, 0x4, 0x5}, {0x2c, 0x5, [{0x0, 0x8a, 0x7f, 0x401}, {0x800, 0x4, 0x8, 0x9}, {0x0, 0x6, 0x9, 0x1a5e}, {0x9, 0x5, 0x3}, {0x4, 0x9, 0x2, 0x7f3}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x6}]}}]}, 0x490}, 0x1, 0x0, 0x0, 0x84}, 0x8000) openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) socket(0x400000000010, 0x3, 0x0) (async) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) (async) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000040)={0xa, @pix_mp={0x3, 0x708, 0x49433553, 0x4, 0x3, [{0x6, 0x1}, {0x0, 0x75f7eb8a}, {0x0, 0x9ea9}, {0x6, 0xffffffff}, {0xffffffdf, 0xffffffff}, {0x5}, {0xe5a9, 0x5}, {0x3e92, 0x3}], 0x1f, 0x3, 0x8, 0x0, 0x3}}) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@newtfilter={0x490, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_bpf={{0x8}, {0x464, 0x2, [@TCA_BPF_ACT={0x41c, 0x1, [@m_bpf={0xa0, 0x8, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8, 0x5, r0}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x7f, 0x88, 0x7, 0x2}, {0xc232, 0xfe, 0x1, 0xfffffff7}, {0x40, 0x2, 0x54, 0xf7ba}, {0x2, 0x9, 0xb, 0x9af8}, {0x3, 0x40, 0x4, 0x4}, {0x8, 0x1, 0x3, 0x4}, {0x1, 0x2, 0x7, 0x6}]}, @TCA_ACT_BPF_FD={0x8, 0x5, r3}]}, {0x29, 0x6, "66fbdd594b36c7f23c319172c27931a35afba812dc5608ee185c9ffbc6d71fc2a37030288a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_skbmod={0x16c, 0x10, 0x0, 0x0, {{0xb}, {0x6c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x7, 0x5, 0x3, 0x1, 0x3}, 0x2}}]}, {0xd7, 0x6, "e151a1960d2fae49bdf035b44576d6e3df9aa672b61dae3f1dd54a23eeebf3e08e33aed7448b64b6737362551eb8694a31b713db98e37eb7e2c97f6de617c7f33c255d57ed440ecb95749d564c8cf0e89628b4d424d975e0c0521d067b6167ad8ae1557bde675cbc5d2f998719a87beff4b9c2a913d0bce41a6301e8b826ae4a924d7a9f138bddfc7b915582e4e989a81844eb95972a4f0de3f498ad1b4419c38e962ffef5cce99919e783ac095bd16304ae3d68bfc0d206f7d131ef6074fae4a044d536b7d07324b094db9debfa2ca4c87cba"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_xt={0x118, 0x6, 0x0, 0x0, {{0x7}, {0xd8, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_TARG={0x2a, 0x6, {0xd91b, 'mangle\x00', 0x8, 0x4}}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x74e}, @TCA_IPT_INDEX={0x8, 0x3, 0x85a}, @TCA_IPT_TARG={0x36, 0x6, {0x6, 'raw\x00', 0x83, 0x109b, "e51e5487c94b3ed9bf2b2fb5"}}, @TCA_IPT_INDEX={0x8}]}, {0x1b, 0x6, "1198438d5b7b252c6044a5a93303d1ab90582ba1f124b9"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_vlan={0xf4, 0x12, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x2df}]}, {0xbd, 0x6, "d2194ddf1a41bb6dab11d9c1039933a223746ff7a7e6d5894edc6043565790cd951cba0fe4475f512c8694a3d5bafd7aa58b6e74b7ed82c38818b3b58fb8841058b6eea47f6bdf601927d1405ba3942e479d7962632d95f5bcad3f12bebc46f9f4583803fbf67afa41876275a94babb88db3449ecc96a221b6e68914600e8d3b71fa88506291918ca1131f200fc12a942a6ba9e6e44b7648def4167c0caef265d45743ccbc99f7fc53ce840ba6e37a348f7791fcb985cce74f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_OPS={{0x6, 0x4, 0x5}, {0x2c, 0x5, [{0x0, 0x8a, 0x7f, 0x401}, {0x800, 0x4, 0x8, 0x9}, {0x0, 0x6, 0x9, 0x1a5e}, {0x9, 0x5, 0x3}, {0x4, 0x9, 0x2, 0x7f3}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x6}]}}]}, 0x490}, 0x1, 0x0, 0x0, 0x84}, 0x8000) (async) 3.654397807s ago: executing program 0 (id=1572): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="300000001e00010d040000000000000007000000", @ANYRES32=0x0, @ANYBLOB="01a000000150040008000a"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x40080) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000005480)=ANY=[@ANYBLOB="0500000008ff"]) 3.229505667s ago: executing program 0 (id=1573): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mknod(&(0x7f00000000c0)='./file1/file3\x00', 0xc000, 0x81b) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100), 0x18002, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7}}, {@blksize={'blksize', 0x3d, 0x200}}], [{@subj_user={'subj_user', 0x3d, '-('}}, {@obj_user={'obj_user', 0x3d, '-&'}}, {@uid_lt={'uid<', 0xee01}}, {@dont_appraise}, {@uid_eq={'uid', 0x3d, r1}}]}}) r2 = socket(0x2b, 0x80801, 0x1) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0xab, @empty, 0x1}, 0x1c) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000ec0)={'filter\x00', 0xb001, 0x4, 0x3c8, 0x110, 0x1f8, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@multicast2, @local, 0xff, 0xff000000, 0x3, 0x9, {@mac=@remote, {[0xff, 0xff, 0xff, 0x0, 0xff]}}, {@mac=@local, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x1, 0xf7fd, 0x5, 0x7, 0x7, 0xfff, 'tunl0\x00', 'hsr0\x00', {}, {}, 0x0, 0x10a}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @dev={0xac, 0x14, 0x14, 0x3a}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0x0, 0x1e03}}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x8de, 0x400}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, 0x0, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, [@CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4008095}, 0x24040010) r3 = landlock_create_ruleset(&(0x7f0000000440)={0x7511, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000021c0)='./file1/file3\x00', 0x2) 2.864403828s ago: executing program 4 (id=1574): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x80, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mknod(&(0x7f00000000c0)='./file1/file3\x00', 0xc000, 0x81b) r3 = landlock_create_ruleset(&(0x7f0000000440)={0x7511, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000021c0)='./file1/file3\x00', 0x2) socket$inet6(0x10, 0x80000, 0x3) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000001c0)=@mmap={0x0, 0x1, 0x4, 0x20, 0x0, {0x77359400}, {0x4, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x291d}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000100)=0x1) r5 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)=@newtfilter={0x24, 0x2c, 0xd2b, 0x10000, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x2d5e9a624ed3e1fd}, {0xf}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x893}, 0x24040084) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)="17", 0x1}], 0x1}}], 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) 2.862705501s ago: executing program 0 (id=1575): syz_usb_connect(0x1, 0xfffffffffffffd22, 0x0, 0x0) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r0, &(0x7f0000000080)=ANY=[], 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000002580)={0x8, {"a2e3ad21ed6b52f99cfbf4c087f70c1b3e6ee7ff7fc6e5539b9b3b0e8b9b411b5d52091b080d29428f0e1ac6e7049b3468959b4c9a242a9b67f3988f7ef319520200ffe8d178708c523c921b1b25380a169b63d336cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295cba0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783f287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4fe5b7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d7d8ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a050011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae003050000004908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e45df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0, 0xeee70004}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000a40)={0x1, 0x0, [{0xeeee5000, 0xf0, &(0x7f0000000940)=""/240}]}) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) unshare(0x64000600) r6 = fanotify_init(0x20, 0x2) r7 = syz_open_dev$vbi(&(0x7f0000001c40), 0x1, 0x2) ioctl$VIDIOC_QBUF(r7, 0xc058560f, &(0x7f0000001c80)=@multiplanar_mmap={0x4d, 0xd, 0x4, 0xe000, 0x7, {}, {0x5, 0x1, 0x1, 0xd6, 0x5, 0x81, "36053797"}, 0x6, 0x1, {0x0}, 0x7f85}) statx(r2, &(0x7f0000000200)='./file0\x00', 0x800, 0x800, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r5, 0xc018937b, &(0x7f0000000680)={{0x1, 0x1, 0x18, r6, {0xee00, 0xee00}}, './file0\x00'}) mount$fuseblk(&(0x7f0000000080), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xc8000, &(0x7f00000006c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r8}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@allow_other}, {@blksize={'blksize', 0x3d, 0x1600}}, {@default_permissions}, {@default_permissions}, {@default_permissions}, {@blksize}, {@allow_other}, {@blksize}, {@allow_other}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}]}}) close_range(r6, 0xffffffffffffffff, 0x0) 2.328214304s ago: executing program 3 (id=1576): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000001440), 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000080)=0x14) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f00000000c0)=0x32) close(r0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002502000020feffff7a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe5d6405000000000075040000000d00000701000000000000b70400001000e5206a1f00fe000000008500000088000000b70000000a00000095000000000000006458c2c62fc206000000f909a63796c113a80c19aab9d60700ffffffff483be3f0d3253730e78000000062c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766aeb39439fce41f144631ac262dcae08c3d1a1fbe96dd87235b44174f7c013700e69274f8e9c31975e551558055dc2dc29edc33b375fa325dcf3e91e20f63d7030dbe7ff7f51fe89c3d17cf45a1616ad237682057034dfdc81f5a53cd640212cad88e8b687a2446049577c75b76b775c1e80dbc4ba3ce2e95c02301caf2465ed4b2ad56b848d046c52bfc3737127120ab17d82a294d174f240a3cdc725cfe6e839a1f80f59486578e45b008d39ab618f660e3c53ed4409aa92ae4fecd913060ca74ed8a303e22de12087a217d8d7be0ae1117cc791313b1318497dd5ebeef0d7e1795a6ff20f699870ebb137cffa79465da52ab2b3430ba0ba59152496a1ea5dd1e4dee46f6d3688603b5f25a588a31da4e481884074e211dd09a8b8039d0834507656ed7d552a990c1354d7638b2c2215dd9f606b01a92fabc6eb6fa033a86f8920e2168a80d7c86da5ad1d27c8d2a180e56046a49b989128ea736894d3eef8dca16ed63520be4654ddb14bfe4268c487c5a75c044e21021c089608c50adbc4e3f4c6a4ca86c7d2df5bc7c76e413d05e8f57b1e22d4af34f9d4d2e6e4d4f57f47aebdd5f98f67834c656b2fe09df4a1b15116fceaa404a6df278c7c629f584ba8d37c1137c2263ae02ad3718a03a886"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x139}, 0x48) 1.995506393s ago: executing program 3 (id=1577): ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x8, 0x0, 0x70, @dev={0xfe, 0x80, '\x00', 0xb}, @mcast2, 0x7800, 0x9, 0x3, 0x8}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_usb_connect(0x4, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007e618a08580403701a7a010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000080)={0x2c, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000400)={0x14, &(0x7f0000000680)=ANY=[@ANYBLOB="000f3b0000003bbdf5eee7cc73e25703a8959e2df84c9aeaa01ad0e57fda702d7299d9e99cfbe5ef84721012a5c14654696180abd77c0d2b247e2f5f67000000000000000000000000bd9413e15d325c63644f4d56541540dad9c0ce4f924ee6af1bf9208f456c1f29be5465ccbaf7ab4b35cfb3b9dd446e74ac0eb73f01f87fa88d8cdf4fafad12ec1fcbd436c662c7fa83e53a26399eb9eb402853f39b61b2ee4414f96da013b333f4a91286068c4f2bb38eac036e4055cbfa801526cb5612ff138d5a5ee4bff763f91d9da52e58992cf7ea489f3e5e939359d7d4be9ad6548ae7fbd6b372"], &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000940)={0x44, &(0x7f0000000540)={0x40, 0x16, 0xfe, "6e0c9887511af29c24dad76d06522dd261f24e4099b72045bf5cbfa0670d72c74eb361522e84f62c6f213582dee82f438dc55231fd22357abba894b713d36602bb5912f364912ee8a99d906601c6016ab5b159c8e5a3eb89c9ac63d74b9299dc90b3179fff01e091dbc69419b814d569ee035c7065320c9a6c23a8c015358d6a6e98d6197458549e4cadc5f16a54f0ba92f74893c446aa2c4085e6ae7fb2592e3aab4d596373f7347b7d1aeb5abef8d43cb3ad5d7406a006a4e7b1dff975b8e544aa6c4089d734575f9df4086f2b7d66e9920802d8f1d634bddd23de637a4a19650dfd218bbb5d85d20ad089bef6e6bc81141eef9f11fcffb6b856aeaba7"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0xc}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000800)={0x20, 0x80, 0x1c, {0xc, 0x0, 0x8, 0x0, 0x6, 0x7fff, 0x9, 0x9, 0x8, 0x7, 0x400, 0x9}}, &(0x7f0000000180)={0x20, 0x85, 0x4, 0x516}, &(0x7f0000000880)={0x20, 0x83, 0x2, 0x1}, 0x0, &(0x7f0000000900)={0x20, 0x89, 0x2}}) r2 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd2(0x5, 0x801) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000080)={0x72dce253, 0x0, 0x0, r5}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) socket(0x1e, 0x4, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x351}, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x3, 0x71, &(0x7f00000009c0)=ANY=[@ANYBLOB="12010003000000406b1d010140000102030109025f0003010420050904000000010100000a24010500030201020904010000010200470904010101010200000905010900004320020725018208020009040200000102000009040201010102000009058209000403010164250102e8000005439dec480feda393a295443420e948d6ca78c7e58dba4e9ad64fcbac328f15564884d81a4697f11e7926594628b399a84f61b57d7bcb10ba887bfe9502891daa8761138b6001dd91209f1698dd15c6d996"], 0x0) migrate_pages(r7, 0x5, 0x0, &(0x7f0000000080)=0x272) r8 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000340), 0x40040, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f00000000c0)={0x3b, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r9, 0x3b82, &(0x7f0000000100)={0x18, r10, 0xfffffffffffffe86, 0x0, 0x0}) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffd, 0x6, 0xff, @scatter={0x0, 0x1200, 0x0}, &(0x7f00000000c0)="eaff48000000", 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 1.983551161s ago: executing program 1 (id=1578): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f0000000080)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.797040213s ago: executing program 2 (id=1579): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000680)=@nat={'nat\x00', 0x1b, 0x5, 0x490, 0x528, 0x258, 0xffffffff, 0x378, 0x0, 0x528, 0x528, 0xffffffff, 0x528, 0x528, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x1c, @ipv6=@remote, @ipv4=@multicast2, @icmp_id=0x64, @icmp_id=0x65}}}, {{@ipv6={@private1, @loopback, [0xffffff, 0xff000000, 0xffffff00, 0xff], [0xffffff00, 0x0, 0x0, 0xff], 'veth1\x00', 'vcan0\x00', {}, {0xff}, 0x4, 0x1, 0x1, 0x15}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x9, @ipv4=@loopback, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @port=0x4e23, @port=0x4e24}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x3c}, [0x0, 0xffffffff, 0xffffffff, 0xff], [0xff, 0xff, 0xff, 0xff], 'macvlan1\x00', 'wg2\x00', {0xff}, {0xff}, 0x32, 0x4, 0x6, 0xc}, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x12, @ipv4=@loopback, @ipv4=@local, @icmp_id=0x66, @gre_key=0xf}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x11, @ipv6=@loopback, @ipv4=@private=0xa010100, @port=0x4e24, @icmp_id=0x65}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f0) r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000480)=0x5) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x410042, 0x0) (async) r2 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x410042, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) (async) r3 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) pidfd_getfd(r2, r3, 0x0) (async) pidfd_getfd(r2, r3, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) timer_create(0x2, &(0x7f0000000180)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000000c0)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, 0x0) (async) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r9) sendmsg$NL80211_CMD_REGISTER_BEACONS(r6, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000001500)=ANY=[@ANYBLOB, @ANYRES16=r10, @ANYBLOB="010007bd7000fddbdf2555000000080001006400000008000300", @ANYRES32=r7, @ANYBLOB="0c0099000b00000043000000"], 0x30}, 0x1, 0x0, 0x0, 0x40000a0}, 0x810) (async) sendmsg$NL80211_CMD_REGISTER_BEACONS(r6, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000001500)=ANY=[@ANYBLOB, @ANYRES16=r10, @ANYBLOB="010007bd7000fddbdf2555000000080001006400000008000300", @ANYRES32=r7, @ANYBLOB="0c0099000b00000043000000"], 0x30}, 0x1, 0x0, 0x0, 0x40000a0}, 0x810) sendmsg$NL80211_CMD_REGISTER_BEACONS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fedbdf2555000000080001005c00000008000300", @ANYRES32=r7], 0x30}, 0x1, 0x0, 0x0, 0x40895}, 0x4044840) (async) sendmsg$NL80211_CMD_REGISTER_BEACONS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fedbdf2555000000080001005c00000008000300", @ANYRES32=r7], 0x30}, 0x1, 0x0, 0x0, 0x40895}, 0x4044840) close_range(r4, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) (async) r11 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r11, &(0x7f0000002340)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e22, 0xe2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10000}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000180)="b0", 0x1}], 0x1}}], 0x2, 0x0) shutdown(r11, 0x1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r11, 0x84, 0x84, &(0x7f0000000240)={0x0, @in6={{0x2, 0x0, 0x0, @local, 0x2003}}}, &(0x7f0000000040)=0x90) sysinfo(&(0x7f0000000100)=""/182) (async) sysinfo(&(0x7f0000000100)=""/182) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000200)) 1.495510999s ago: executing program 1 (id=1580): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 1.145839871s ago: executing program 1 (id=1581): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x4001) sched_setattr(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x6757, 0x10000, 0x0, 0x1cd}, &(0x7f0000000440)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000140)=@IORING_OP_MSG_RING={0x28, 0x0, 0x0, r3, 0x0, 0x0}) io_uring_enter(r3, 0x14, 0xb9c, 0x3, 0x0, 0xffffffd5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_CAP_HALT_POLL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0xdf, 0x0, 0x10000}) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001400)=ANY=[@ANYBLOB="1c0000001a000100"/19], 0x1c}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffff7b, 0x0}, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r7, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) pread64(r7, &(0x7f0000000080)=""/110, 0x88, 0x400) r8 = add_key$keyring(&(0x7f00000018c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0x0) add_key$fscrypt_v1(0x0, &(0x7f0000001800)={'fscrypt:', @desc1}, &(0x7f0000000300)={0x0, "e857c32234bfbc6e2ee8cc17d2fcb69c1f772ae98aa5abb6a592da302abdd67c82ff8fe37596bfcdb6c800ca766581cd46000d12e10854de6591cd74e20cb2ff", 0x2d}, 0x48, r8) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 659.122722ms ago: executing program 2 (id=1582): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_control(r0, &(0x7f0000000040)='disconnect aa:aa:aa:aa:aa:10 2', 0x1e) syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x0, 0x10100, 0x4000000}, 0x0, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="33fe000078009106000000000000004a07"], 0xfe33) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000370400"/20, @ANYRES32=0x0, @ANYRESDEC=r2], 0x44}}, 0x0) 231.445975ms ago: executing program 0 (id=1583): r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000040)={0x1, "a09df7a4ef6dcaa8b45533dc7d0038bcbe00bd4d09a5871ab4005736f48b486f", 0xffffffffffffffff}) r2 = dup(r1) r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x1, 0x0) ioctl$MON_IOCX_GET(r3, 0x40189206, &(0x7f0000000180)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000100)=""/73, 0x49}) read$FUSE(r2, &(0x7f00000001c0)={0x2020}, 0x2020) (async, rerun: 32) io_setup(0x9, &(0x7f0000002200)) (async, rerun: 32) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000002240), 0x101000, 0x0) close_range(r4, r3, 0x0) (async) r5 = syz_open_dev$hiddev(&(0x7f0000002280), 0x6, 0x111000) ioctl(r5, 0x5, &(0x7f00000022c0)="266dee6833dbc9db30416623a79ca3a53a9432259a2aca1319fcc8f895387cb2c54395431851e2892658cb6d14313f88") r6 = accept4(r2, &(0x7f0000002300)=@in={0x2, 0x0, @private}, &(0x7f0000002380)=0x80, 0x80000) (async) r7 = socket$l2tp6(0xa, 0x2, 0x73) (async) r8 = syz_create_resource$binfmt(&(0x7f00000023c0)='./file0\x00') execveat$binfmt(r2, r8, &(0x7f00000024c0)={[&(0x7f0000002400)='/dev/usbmon#\x00', &(0x7f0000002440)='\x00', &(0x7f0000002480)='/dev/qat_adf_ctl\x00']}, &(0x7f0000002600)={[&(0x7f0000002500)='{]\x00', &(0x7f0000002540)='\x00', &(0x7f0000002580)='^\x00', &(0x7f00000025c0)='\x00']}, 0x400) r9 = open$dir(&(0x7f0000002640)='./file0\x00', 0x101000, 0x80) renameat(r9, &(0x7f0000002680)='./file0\x00', r7, &(0x7f00000026c0)='./file0\x00') (async) r10 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x12, r2, 0x8000000) (async, rerun: 64) syz_io_uring_setup(0x3d80, &(0x7f0000002700)={0x0, 0x2703, 0x8, 0x1, 0x342, 0x0, r2}, &(0x7f0000002780), &(0x7f00000027c0)=0x0) (rerun: 64) syz_io_uring_submit(r10, r11, &(0x7f0000002800)=@IORING_OP_SEND={0x1a, 0x1, 0x0, r6, 0x0, 0xfffffffffffffffd, 0x0, 0x4000804, 0x1}) (async) r12 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x40) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) (async, rerun: 64) recvmsg$kcm(r6, &(0x7f0000002dc0)={&(0x7f0000002840)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000002d00)=[{&(0x7f00000028c0)=""/106, 0x6a}, {&(0x7f0000002940)=""/231, 0xe7}, {&(0x7f0000002a40)=""/50, 0x32}, {&(0x7f0000002a80)=""/11, 0xb}, {&(0x7f0000002ac0)=""/21, 0x15}, {&(0x7f0000002b00)=""/122, 0x7a}, {&(0x7f0000002b80)=""/245, 0xf5}, {&(0x7f0000002c80)=""/69, 0x45}], 0x8, &(0x7f0000002d80)=""/32, 0x20}, 0x2020) (async, rerun: 64) ioctl$KVM_CAP_MSR_PLATFORM_INFO(r2, 0x4068aea3, &(0x7f0000002e00)={0x9f, 0x0, 0x1}) (async) mkdir(&(0x7f0000002e80)='./file0\x00', 0x2) (async) r13 = syz_io_uring_setup(0x4b21, &(0x7f0000002ec0)={0x0, 0x42be, 0x40, 0x1, 0x4b, 0x0, r3}, &(0x7f0000002f40), &(0x7f0000002f80)) io_uring_register$IORING_REGISTER_PBUF_STATUS(r13, 0x1a, &(0x7f0000002fc0)={0x7}, 0x1) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0xc06c4124, &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) dup3(r5, r12, 0x80000) 0s ago: executing program 2 (id=1584): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f1068", 0x9, 0xfffffffffffffffe) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x2000081) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000480)=@ethtool_sfeatures={0x3b, 0x2, [{0xff}, {0xfffffff9}]}}) add_key(&(0x7f00000001c0)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r5, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0xffffffffffffffb3, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x900, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0x1067, 0x40, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) r11 = socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz0\x00', 0x1ff) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r11, 0x84, 0x22, &(0x7f0000000000)={0x7, 0x8, 0x6, 0x7}, &(0x7f0000000140)=0x10) r12 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r12, 0x0, 0x80, &(0x7f0000000300)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x800001c0, 0x0, 0x0, 0x800001f0, 0x80000220], 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000d4b15ad640097f1474f039670000000000000000000000000000000000000000000000000000000000ef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff"]}, 0x110) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) kernel console output (not intermixed with test programs): ess `syz.2.1210'. [ 458.039601][ T9793] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 458.134518][T10576] CPU: 0 UID: 0 PID: 10576 Comm: syz.1.1209 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 458.134548][T10576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 458.134561][T10576] Call Trace: [ 458.134569][T10576] [ 458.134579][T10576] dump_stack_lvl+0x189/0x250 [ 458.134609][T10576] ? __pfx____ratelimit+0x10/0x10 [ 458.134632][T10576] ? __pfx_dump_stack_lvl+0x10/0x10 [ 458.134663][T10576] ? __pfx__printk+0x10/0x10 [ 458.134698][T10576] ? __pfx___might_resched+0x10/0x10 [ 458.134726][T10576] should_fail_ex+0x414/0x560 [ 458.134754][T10576] ? io_alloc_cache_init+0x3d/0x140 [ 458.134780][T10576] should_failslab+0xa8/0x100 [ 458.134817][T10576] __kvmalloc_node_noprof+0x161/0x5f0 [ 458.134848][T10576] ? io_alloc_cache_init+0x3d/0x140 [ 458.134884][T10576] io_alloc_cache_init+0x3d/0x140 [ 458.134915][T10576] io_ring_ctx_alloc+0x491/0xae0 [ 458.134951][T10576] io_uring_create+0x130/0xb60 [ 458.134987][T10576] __se_sys_io_uring_setup+0x264/0x270 [ 458.135009][T10576] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 458.135046][T10576] ? __secure_computing+0xe2/0x2a0 [ 458.135079][T10576] do_syscall_64+0xfa/0x3b0 [ 458.135103][T10576] ? lockdep_hardirqs_on+0x9c/0x150 [ 458.135125][T10576] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.135146][T10576] ? clear_bhb_loop+0x60/0xb0 [ 458.135171][T10576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.135191][T10576] RIP: 0033:0x7fc4df18e9a9 [ 458.135210][T10576] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 458.135228][T10576] RSP: 002b:00007fc4e00ccfc8 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 458.135251][T10576] RAX: ffffffffffffffda RBX: 00007fc4df3b5fa0 RCX: 00007fc4df18e9a9 [ 458.135266][T10576] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000002c0e [ 458.135279][T10576] RBP: 0000200000000400 R08: 0000000000000000 R09: 0000000000000000 [ 458.135292][T10576] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 458.135304][T10576] R13: 0000000000000000 R14: 0000000000002c0e R15: 0000000000000000 [ 458.135334][T10576] [ 458.451131][ T9793] usb 5-1: device descriptor read/64, error -71 [ 458.736322][ T9793] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 458.874349][ T9793] usb 5-1: device descriptor read/64, error -71 [ 459.055648][ T9793] usb usb5-port1: attempt power cycle [ 459.064086][ T5916] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 459.230435][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 459.243193][ T5916] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 459.253493][ T5916] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid maxpacket 1152, setting to 1024 [ 459.268058][ T5916] usb 2-1: config 0 interface 0 has no altsetting 0 [ 459.282039][ T5916] usb 2-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 459.292288][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.301568][ T5916] usb 2-1: Product: syz [ 459.306536][ T5916] usb 2-1: Manufacturer: syz [ 459.311459][ T5916] usb 2-1: SerialNumber: syz [ 459.336876][ T5916] usb 2-1: config 0 descriptor?? [ 459.362552][T10587] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 459.446978][ T9793] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 459.485360][ T9793] usb 5-1: device descriptor read/8, error -71 [ 459.586976][T10587] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 459.644191][ T9309] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 459.656685][ T5916] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input54 [ 459.812122][T10587] netdevsim netdevsim1: Direct firmware load for . [ 459.812122][T10587] failed with error -2 [ 459.824398][ T9793] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 459.832269][T10587] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 459.832269][T10587] [ 459.854380][ T9309] usb 1-1: Using ep0 maxpacket: 16 [ 459.863623][ T9309] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 459.874716][ T9793] usb 5-1: device descriptor read/8, error -71 [ 459.903237][ T9309] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 459.937057][ T9309] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 459.947260][ T9309] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 459.958927][ T9309] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 459.969722][ T9309] usb 1-1: config 0 has no interface number 0 [ 459.980783][ T9309] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 459.997610][ T9309] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 460.008819][ T9793] usb usb5-port1: unable to enumerate USB device [ 460.035312][ T9309] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 460.045744][ T9309] usb 1-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 460.059793][ T9309] usb 1-1: config 0 interface 125 has no altsetting 0 [ 460.069198][ T9309] usb 1-1: config 0 interface 125 has no altsetting 2 [ 460.081927][ T9309] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 460.093777][ T9309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.102628][ T9309] usb 1-1: Product: syz [ 460.107414][ T9309] usb 1-1: Manufacturer: syz [ 460.112294][ T9309] usb 1-1: SerialNumber: syz [ 460.130560][ T9309] usb 1-1: config 0 descriptor?? [ 460.148933][ T9309] usb 1-1: selecting invalid altsetting 2 [ 460.663675][ C0] usb 1-1: async_complete: urb error -71 [ 460.669588][ C0] usb 1-1: async_complete: urb error -71 [ 460.675408][ C0] usb 1-1: async_complete: urb error -71 [ 460.681406][ C0] usb 1-1: async_complete: urb error -71 [ 460.695218][ T9309] get_1284_register: usb error -71 [ 460.730632][ T9309] uss720 1-1:0.125: probe with driver uss720 failed with error -71 [ 460.748467][ T9309] usb 1-1: USB disconnect, device number 96 [ 461.314523][T10605] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1217'. [ 461.911593][T10614] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.959999][T10614] trusted_key: encrypted_key: insufficient parameters specified [ 461.995143][T10614] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 462.067938][ T5916] usb 2-1: USB disconnect, device number 79 [ 462.364807][T10626] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 462.426689][T10626] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 462.490225][T10630] tipc: Started in network mode [ 462.507269][T10630] tipc: Node identity de830b7b8ace, cluster identity 4711 [ 462.547624][T10630] tipc: Enabled bearer , priority 0 [ 462.574700][T10632] syzkaller0: entered promiscuous mode [ 462.601088][T10632] syzkaller0: entered allmulticast mode [ 462.674830][T10630] tipc: Resetting bearer [ 462.762700][T10629] tipc: Resetting bearer [ 462.932426][T10629] tipc: Disabling bearer [ 463.124310][ T5916] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 463.343098][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 463.443937][ T5916] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 463.464535][ T5916] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 463.488136][ T5916] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 463.527255][ T5916] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 463.569275][ T5916] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 463.664641][ T5916] usb 2-1: config 0 has no interface number 0 [ 463.803249][ T5916] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 463.897315][ T5916] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 463.923675][ T5916] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 463.944348][ T5916] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 463.969361][ T5916] usb 2-1: config 0 interface 125 has no altsetting 0 [ 464.123940][ T5916] usb 2-1: config 0 interface 125 has no altsetting 2 [ 464.175239][ T5916] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 464.191781][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.221247][ T5916] usb 2-1: Product: syz [ 464.231385][ T5916] usb 2-1: Manufacturer: syz [ 464.245855][ T5916] usb 2-1: SerialNumber: syz [ 464.262784][ T5916] usb 2-1: config 0 descriptor?? [ 464.285968][ T5916] usb 2-1: selecting invalid altsetting 2 [ 464.434338][ T9309] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 464.594654][ T9309] usb 1-1: Using ep0 maxpacket: 16 [ 464.619617][ T9309] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 464.661987][ T9309] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 464.695679][ T9309] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 464.705963][ T9309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.714652][ T9309] usb 1-1: Product: syz [ 464.720147][ T9309] usb 1-1: Manufacturer: syz [ 464.728958][ T9309] usb 1-1: SerialNumber: syz [ 464.742983][ T9309] usb 1-1: config 0 descriptor?? [ 464.754604][ C1] usb 2-1: async_complete: urb error -71 [ 464.760582][ C1] usb 2-1: async_complete: urb error -71 [ 464.766313][ C1] usb 2-1: async_complete: urb error -71 [ 464.772076][ C1] usb 2-1: async_complete: urb error -71 [ 464.778236][ T5916] get_1284_register: usb error -71 [ 464.783578][ T5916] uss720 2-1:0.125: probe with driver uss720 failed with error -71 [ 464.788456][ T9309] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 464.798832][ T5916] usb 2-1: USB disconnect, device number 80 [ 464.818923][ T9309] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 465.191835][T10674] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1235'. [ 465.201661][T10674] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1235'. [ 465.397402][T10697] loop4: detected capacity change from 0 to 2560 [ 465.419543][ T9309] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 465.428375][ T9309] em28xx 1-1:0.0: Config register raw data: 0xac [ 465.435004][ T9309] em28xx 1-1:0.0: I2S Audio (1 sample rate(s)) [ 465.441539][ T9309] em28xx 1-1:0.0: No AC97 audio processor [ 465.542193][T10687] tipc: New replicast peer: 255.255.255.255 [ 465.559157][ T5941] buffer_io_error: 7 callbacks suppressed [ 465.559177][ T5941] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 465.593335][T10687] tipc: Enabled bearer , priority 10 [ 465.606696][T10697] Buffer I/O error on dev loop4, logical block 256, lost async page write [ 465.616427][T10704] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1241'. [ 465.655474][ T5941] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 465.668331][T10697] Buffer I/O error on dev loop4, logical block 257, lost async page write [ 465.687531][T10697] Buffer I/O error on dev loop4, logical block 258, lost async page write [ 465.703310][ T5941] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 465.752539][ T5941] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 465.808658][ T5941] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 466.014414][ T5916] usb 2-1: new low-speed USB device number 81 using dummy_hcd [ 466.047228][ T5941] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 466.099691][ T5941] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 466.366524][ T5916] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 466.432533][ T5916] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 466.486322][ T5916] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 466.514729][ T5916] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 466.535064][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 466.573588][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 466.644829][ T5916] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 466.714278][ T9309] tipc: Node number set to 436293487 [ 466.746660][ T5916] usb 2-1: string descriptor 0 read error: -22 [ 466.769827][ T5916] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 466.806520][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.828913][ T5916] usb 2-1: config 0 descriptor?? [ 466.846588][ T5916] hub 2-1:0.0: bad descriptor, ignoring hub [ 466.873722][ T5916] hub 2-1:0.0: probe with driver hub failed with error -5 [ 466.972073][ T5916] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input55 [ 467.208682][ T9309] usb 1-1: USB disconnect, device number 97 [ 467.321220][ T9312] usb 2-1: USB disconnect, device number 81 [ 467.918979][ T5916] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 468.144207][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 468.151513][ T5916] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 468.164117][ T9312] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 468.251932][ T5916] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 468.584143][ T9312] usb 3-1: Using ep0 maxpacket: 16 [ 468.594935][ T9312] usb 3-1: config 0 has an invalid interface number: 145 but max is 0 [ 468.603332][ T9312] usb 3-1: config 0 has no interface number 0 [ 468.615605][ T9312] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 468.629639][ T9312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.639823][ T9312] usb 3-1: Product: syz [ 468.644776][ T9312] usb 3-1: Manufacturer: syz [ 468.654401][ T9312] usb 3-1: SerialNumber: syz [ 468.673977][ T9312] usb 3-1: config 0 descriptor?? [ 468.679154][ T5916] usb 4-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 468.732868][ T9312] hub 3-1:0.145: bad descriptor, ignoring hub [ 468.746571][ T9312] hub 3-1:0.145: probe with driver hub failed with error -5 [ 468.763225][ T5916] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.773008][ T9312] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.145/input/input56 [ 468.807488][ T5916] usb 4-1: config 0 descriptor?? [ 468.833366][T10739] fuse: Bad value for 'fd' [ 468.872222][T10739] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 468.943375][T10741] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1250'. [ 469.250193][ T5916] usbhid 4-1:0.0: can't add hid device: -71 [ 469.256581][ T5916] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 469.347660][ T5916] usb 4-1: USB disconnect, device number 68 [ 469.504169][ T5917] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 469.814164][ T5917] usb 1-1: Using ep0 maxpacket: 16 [ 469.907461][ T5917] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 470.150675][ T5917] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 470.165394][ T5917] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 470.175288][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.183651][ T5917] usb 1-1: Product: syz [ 470.216353][ T5917] usb 1-1: Manufacturer: syz [ 470.231611][ T5917] usb 1-1: SerialNumber: syz [ 470.335479][ T5917] usb 1-1: config 0 descriptor?? [ 470.347106][ T5917] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 470.357998][ T5917] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 470.558748][T10760] ip6tnl1: entered promiscuous mode [ 470.581858][T10760] ip6tnl1: entered allmulticast mode [ 470.854140][ T9309] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 470.981575][ T5917] em28xx 1-1:0.0: chip ID is em2870 [ 470.994889][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 471.004112][ T9309] usb 4-1: device descriptor read/64, error -71 [ 471.186151][ T5917] usb 1-1: USB disconnect, device number 98 [ 471.194764][ T5917] em28xx 1-1:0.0: Disconnecting em28xx [ 471.206080][ T5917] em28xx 1-1:0.0: Freeing device [ 471.274156][ T9309] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 471.454301][ T9309] usb 4-1: device descriptor read/64, error -71 [ 471.600117][ T9309] usb usb4-port1: attempt power cycle [ 471.664685][ T9312] usb 3-1: USB disconnect, device number 76 [ 471.984265][ T9309] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 472.040477][ T9309] usb 4-1: device descriptor read/8, error -71 [ 472.068274][ T30] kauditd_printk_skb: 267 callbacks suppressed [ 472.068291][ T30] audit: type=1400 audit(1753188327.551:6749): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=10762 comm="syz.2.1255" [ 472.116113][T10773] usb usb8: usbfs: process 10773 (syz.2.1255) did not claim interface 0 before use [ 472.396306][ T9309] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 472.435575][ T9309] usb 4-1: device descriptor read/8, error -71 [ 472.574275][ T9309] usb usb4-port1: unable to enumerate USB device [ 472.824464][ T9312] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 472.914269][ T5917] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 473.002387][ T9312] usb 1-1: config 0 has no interfaces? [ 473.114370][ T5917] usb 5-1: Using ep0 maxpacket: 8 [ 473.122643][ T5917] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 473.132233][ T9312] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 473.175090][ T5917] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 473.185296][ T9312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.193617][ T9312] usb 1-1: Product: syz [ 473.198610][ T5917] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 473.243329][ T5917] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 1824, setting to 1024 [ 473.254179][ T9312] usb 1-1: Manufacturer: syz [ 473.269761][ T9312] usb 1-1: SerialNumber: syz [ 473.294271][ T5917] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 473.320781][ T5917] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 473.321884][ T9312] usb 1-1: config 0 descriptor?? [ 473.426002][ T5917] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 473.480959][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.759977][ T5917] usb 5-1: GET_CAPABILITIES returned 0 [ 473.804124][ T5917] usbtmc 5-1:16.0: can't read capabilities [ 474.122696][ T9312] usb 5-1: USB disconnect, device number 85 [ 474.129549][T10789] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 474.167521][T10806] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -19 [ 474.544459][ T9793] usb 1-1: USB disconnect, device number 99 [ 474.824108][ T9312] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 474.908704][T10815] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1263'. [ 475.037035][T10817] FAULT_INJECTION: forcing a failure. [ 475.037035][T10817] name failslab, interval 1, probability 0, space 0, times 0 [ 475.107126][ T9312] usb 3-1: Using ep0 maxpacket: 16 [ 475.217058][ T9312] usb 3-1: config 0 has an invalid interface number: 145 but max is 0 [ 475.240788][ T9312] usb 3-1: config 0 has no interface number 0 [ 475.253143][T10817] CPU: 0 UID: 0 PID: 10817 Comm: syz.1.1266 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 475.253174][T10817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 475.253187][T10817] Call Trace: [ 475.253197][T10817] [ 475.253207][T10817] dump_stack_lvl+0x189/0x250 [ 475.253238][T10817] ? __pfx____ratelimit+0x10/0x10 [ 475.253262][T10817] ? __pfx_dump_stack_lvl+0x10/0x10 [ 475.253287][T10817] ? __pfx__printk+0x10/0x10 [ 475.253321][T10817] ? __pfx___might_resched+0x10/0x10 [ 475.253351][T10817] should_fail_ex+0x414/0x560 [ 475.253379][T10817] should_failslab+0xa8/0x100 [ 475.253412][T10817] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 475.253442][T10817] ? __alloc_skb+0x112/0x2d0 [ 475.253476][T10817] __alloc_skb+0x112/0x2d0 [ 475.253509][T10817] netlink_sendmsg+0x5c6/0xb30 [ 475.253549][T10817] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.253583][T10817] ? aa_sock_msg_perm+0x94/0x160 [ 475.253609][T10817] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 475.253631][T10817] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.253661][T10817] __sock_sendmsg+0x21c/0x270 [ 475.253689][T10817] ____sys_sendmsg+0x505/0x830 [ 475.253726][T10817] ? __pfx_____sys_sendmsg+0x10/0x10 [ 475.253774][T10817] ? import_iovec+0x74/0xa0 [ 475.253806][T10817] ___sys_sendmsg+0x21f/0x2a0 [ 475.253839][T10817] ? __pfx____sys_sendmsg+0x10/0x10 [ 475.253907][T10817] ? __fget_files+0x2a/0x420 [ 475.253924][T10817] ? __fget_files+0x3a0/0x420 [ 475.253952][T10817] __x64_sys_sendmsg+0x19b/0x260 [ 475.253991][T10817] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 475.254032][T10817] ? __pfx_ksys_write+0x10/0x10 [ 475.254057][T10817] ? rcu_is_watching+0x15/0xb0 [ 475.254086][T10817] ? do_syscall_64+0xbe/0x3b0 [ 475.254121][T10817] do_syscall_64+0xfa/0x3b0 [ 475.254144][T10817] ? lockdep_hardirqs_on+0x9c/0x150 [ 475.254166][T10817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.254187][T10817] ? clear_bhb_loop+0x60/0xb0 [ 475.254213][T10817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.254234][T10817] RIP: 0033:0x7fc4df18e9a9 [ 475.254254][T10817] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 475.254273][T10817] RSP: 002b:00007fc4e00cd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 475.254296][T10817] RAX: ffffffffffffffda RBX: 00007fc4df3b5fa0 RCX: 00007fc4df18e9a9 [ 475.254312][T10817] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000004 [ 475.254325][T10817] RBP: 00007fc4e00cd090 R08: 0000000000000000 R09: 0000000000000000 [ 475.254339][T10817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 475.254350][T10817] R13: 0000000000000000 R14: 00007fc4df3b5fa0 R15: 00007fc4df4dfa28 [ 475.254382][T10817] [ 475.584238][ T9312] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 475.593536][ T9312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.601735][ T9312] usb 3-1: Product: syz [ 475.618297][ T9312] usb 3-1: Manufacturer: syz [ 475.623168][ T9312] usb 3-1: SerialNumber: syz [ 475.669078][ T9312] usb 3-1: config 0 descriptor?? [ 475.681284][ T9312] hub 3-1:0.145: bad descriptor, ignoring hub [ 475.690472][ T9312] hub 3-1:0.145: probe with driver hub failed with error -5 [ 475.768988][ T9312] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.145/input/input57 [ 475.815224][ T9295] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 475.980117][T10822] vivid-000: disconnect [ 475.984547][ T9295] usb 1-1: Using ep0 maxpacket: 16 [ 476.011211][ T9295] usb 1-1: config 7 has an invalid interface number: 221 but max is 0 [ 476.026495][ T9295] usb 1-1: config 7 has no interface number 0 [ 476.062105][ T9295] usb 1-1: config 7 interface 221 has no altsetting 0 [ 476.078759][T10824] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1269'. [ 476.090848][ T9295] usb 1-1: New USB device found, idVendor=093a, idProduct=2601, bcdDevice=ff.bc [ 476.100403][ T9295] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.109713][ T9295] usb 1-1: Product: syz [ 476.117116][ T9295] usb 1-1: Manufacturer: syz [ 476.129961][ T9295] usb 1-1: SerialNumber: syz [ 476.383877][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.394633][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.424453][ T9295] gspca_main: pac7311-2.14.0 probing 093a:2601 [ 476.439475][ T9295] gspca_pac7311: reg_w() failed index 0xff, value 0x01, error -71 [ 476.459615][ T9295] pac7311 1-1:7.221: probe with driver pac7311 failed with error -71 [ 476.486261][ T9295] usb 1-1: USB disconnect, device number 100 [ 476.731679][T10833] bridge7: entered promiscuous mode [ 476.748290][T10833] bridge7: entered allmulticast mode [ 476.946707][T10813] vivid-000: reconnect [ 477.106083][T10837] openvswitch: netlink: Message has 8 unknown bytes. [ 477.474413][ T5917] usb 3-1: USB disconnect, device number 77 [ 477.664273][ T9295] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 477.826316][ T9295] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 477.865185][ T9295] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 384, setting to 64 [ 477.885187][ T9295] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 477.908636][ T9295] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.927454][ T9295] usb 4-1: Product: syz [ 477.937628][ T9295] usb 4-1: Manufacturer: syz [ 477.951669][ T9295] usb 4-1: SerialNumber: syz [ 477.975257][ T9295] usb 4-1: config 0 descriptor?? [ 477.989112][T10846] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 478.094221][ T9793] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 478.094366][ T9295] rc_core: IR keymap rc-streamzap not found [ 478.244387][ T9295] Registered IR keymap rc-empty [ 478.251111][ T9295] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 478.319431][ T9295] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input58 [ 478.395794][ T9295] usb 4-1: USB disconnect, device number 73 [ 478.504338][ T9793] usb 5-1: Using ep0 maxpacket: 32 [ 478.520006][ T9793] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 478.557963][ T9793] usb 5-1: config 0 has no interface number 0 [ 478.569067][T10875] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 478.609722][ T9793] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 478.673038][T10875] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 478.706943][ T9793] usb 5-1: config 0 interface 85 has no altsetting 0 [ 478.763424][ T9793] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 478.802224][ T9793] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.894096][ T9793] usb 5-1: Product: syz [ 478.914135][ T9793] usb 5-1: Manufacturer: syz [ 478.922435][ T9793] usb 5-1: SerialNumber: syz [ 478.984130][ T9793] usb 5-1: config 0 descriptor?? [ 479.146650][ T9295] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 479.306223][ T9295] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 479.318207][ T9295] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 479.337172][ T9295] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 479.394191][ T5916] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 479.477856][ T9295] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 479.534756][ T9295] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.606939][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 479.651106][ T5916] usb 4-1: config 0 has an invalid interface number: 145 but max is 0 [ 479.677679][ T9295] usb 3-1: config 0 descriptor?? [ 479.687814][ T5916] usb 4-1: config 0 has no interface number 0 [ 479.732399][ T5916] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 479.746272][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.770902][ T5916] usb 4-1: Product: syz [ 479.776692][ T5916] usb 4-1: Manufacturer: syz [ 479.781822][ T5916] usb 4-1: SerialNumber: syz [ 479.796807][ T5916] usb 4-1: config 0 descriptor?? [ 479.826981][ T5916] hub 4-1:0.145: bad descriptor, ignoring hub [ 479.834253][ T5916] hub 4-1:0.145: probe with driver hub failed with error -5 [ 479.852370][ T5916] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.145/input/input60 [ 480.148733][ T9295] plantronics 0003:047F:FFFF.0010: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 480.662379][T10900] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1290'. [ 480.685963][T10900] netlink: 'syz.0.1290': attribute type 15 has an invalid length. [ 480.707510][T10900] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1290'. [ 480.732190][T10900] netlink: 'syz.0.1290': attribute type 15 has an invalid length. [ 480.745263][T10902] netlink: 'syz.2.1285': attribute type 4 has an invalid length. [ 480.868996][ T9793] appletouch 5-1:0.85: Failed to request geyser raw mode [ 480.882289][ T9793] appletouch 5-1:0.85: probe with driver appletouch failed with error -5 [ 480.951746][ T9793] usb 5-1: USB disconnect, device number 86 [ 481.071123][T10906] fuse: Bad value for 'fd' [ 481.163105][T10906] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 481.460668][T10914] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1294'. [ 481.483145][T10914] unsupported nlmsg_type 40 [ 481.515167][T10917] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1294'. [ 481.725050][ T10] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 481.734216][ T5916] usb 3-1: reset high-speed USB device number 78 using dummy_hcd [ 481.895982][ T10] usb 2-1: config 1 interface 1 has no altsetting 0 [ 481.907660][ T10] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 482.090958][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.154342][ T10] usb 2-1: Product: syz [ 482.164793][ T10] usb 2-1: Manufacturer: syz [ 482.170855][ T10] usb 2-1: SerialNumber: syz [ 482.384545][ T9297] usb 4-1: USB disconnect, device number 74 [ 482.444546][ T10] usb 2-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 482.453430][ T5917] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 482.480657][ T10] usb 2-1: 2:1 : sample bitwidth 232 in over sample bytes 4 [ 482.515105][ T10] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 482.618984][ T9295] usb 3-1: USB disconnect, device number 78 [ 482.669828][ T10] usb 2-1: USB disconnect, device number 82 [ 482.705446][ T5917] usb 5-1: Using ep0 maxpacket: 32 [ 482.750080][ T5917] usb 5-1: unable to get BOS descriptor or descriptor too short [ 482.789938][ T5917] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 482.843105][ T5917] usb 5-1: can't read configurations, error -71 [ 483.097984][T10935] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1300'. [ 483.529627][T10939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1298'. [ 483.641448][T10949] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1305'. [ 484.875441][T10965] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1311'. [ 485.284170][ T9297] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 485.428232][ T10] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 485.523315][ T9297] usb 1-1: Using ep0 maxpacket: 8 [ 485.558976][ T9297] usb 1-1: config 162 has an invalid interface number: 79 but max is 1 [ 485.567760][T10977] PKCS7: Unknown OID: [5] (bad) [ 485.572745][T10977] PKCS7: Only support pkcs7_signedData type [ 485.581859][ T9297] usb 1-1: config 162 has an invalid interface number: 183 but max is 1 [ 485.591189][ T9297] usb 1-1: config 162 has no interface number 0 [ 485.600998][ T9297] usb 1-1: config 162 has no interface number 1 [ 485.608035][ T9297] usb 1-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 485.618732][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 485.658373][ T9297] usb 1-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 485.701738][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 485.719676][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 485.769334][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 485.788781][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 485.810833][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.811621][ T9297] usb 1-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 486.074077][ T10] usb 4-1: Product: syz [ 486.078755][ T10] usb 4-1: Manufacturer: syz [ 486.113826][ T10] usb 4-1: SerialNumber: syz [ 486.241044][ T9297] usb 1-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 486.283433][ T9297] usb 1-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 486.322575][ T9297] usb 1-1: config 162 interface 183 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 486.369977][ T9297] usb 1-1: config 162 interface 79 has no altsetting 0 [ 486.416237][ T9297] usb 1-1: config 162 interface 183 has no altsetting 0 [ 486.447012][ T9297] usb 1-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 486.456987][ T9297] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.477714][ T9297] usb 1-1: Product: syz [ 486.478794][ T10] usb-storage 4-1:1.2: USB Mass Storage device detected [ 486.514054][ T9297] usb 1-1: Manufacturer: syz [ 486.518815][ T9297] usb 1-1: SerialNumber: syz [ 486.635736][ T10] usb 4-1: USB disconnect, device number 75 [ 486.735511][ T6364] udevd[6364]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 486.979153][ T9297] pl2303 1-1:162.79: required endpoints missing [ 487.019037][ T9297] pl2303 1-1:162.183: pl2303 converter detected [ 487.088202][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 487.109039][ T9297] pl2303 1-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 487.120283][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 487.131029][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 487.139901][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 487.150131][ T9297] pl2303 1-1:162.183: pl2303_vendor_write - failed to write [0404]: -71 [ 487.184588][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8484]: -71 [ 487.203669][ T9297] pl2303 1-1:162.183: pl2303_vendor_read - failed to read [8383]: -71 [ 487.263237][ T9297] pl2303 1-1:162.183: pl2303_vendor_write - failed to write [0000]: -71 [ 487.314159][ T9793] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 487.314405][ T9297] pl2303 1-1:162.183: pl2303_vendor_write - failed to write [0001]: -71 [ 487.371188][ T9297] pl2303 1-1:162.183: pl2303_vendor_write - failed to write [0002]: -71 [ 487.412447][ T9297] usb 1-1: pl2303 converter now attached to ttyUSB0 [ 487.467806][ T9793] usb 3-1: Using ep0 maxpacket: 8 [ 487.502041][ T9297] usb 1-1: USB disconnect, device number 101 [ 487.518601][ T9793] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 487.550244][ T9793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.579089][ T9793] usb 3-1: Product: syz [ 487.590303][ T9793] usb 3-1: Manufacturer: syz [ 487.626794][ T9793] usb 3-1: SerialNumber: syz [ 487.641872][ T9297] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 487.657424][ T9793] usb 3-1: config 0 descriptor?? [ 487.668490][ T30] audit: type=1326 audit(1753188343.151:6750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10992 comm="syz.4.1319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 487.693515][ T9297] pl2303 1-1:162.183: device disconnected [ 487.882264][ T30] audit: type=1326 audit(1753188343.151:6751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10992 comm="syz.4.1319" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 487.897683][ T5917] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 487.977213][ T9793] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 488.439749][T11018] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1323'. [ 488.765957][T11016] tipc: Started in network mode [ 488.771155][T11016] tipc: Node identity 62c92b1fb1e4, cluster identity 4711 [ 488.813347][T11016] tipc: Enabled bearer , priority 0 [ 488.830486][T11020] tipc: Enabling of bearer rejected, already enabled [ 488.860447][T11016] mmap: syz.0.1322 (11016): VmData 37593088 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 488.886648][T11016] tipc: Resetting bearer [ 488.924388][ T30] audit: type=1326 audit(1753188344.391:6752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11015 comm="syz.0.1322" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff2cfb8e9a9 code=0x0 [ 489.000871][ T30] audit: type=1326 audit(1753188344.391:6753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11015 comm="syz.0.1322" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff2cfb8e9a9 code=0x0 [ 489.081077][T11015] tipc: Disabling bearer [ 489.202841][ T30] audit: type=1326 audit(1753188344.681:6754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 489.274169][ T30] audit: type=1326 audit(1753188344.681:6755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 489.304909][ T30] audit: type=1326 audit(1753188344.681:6756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 489.333695][ T30] audit: type=1326 audit(1753188344.681:6757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f223438e5ab code=0x7ffc0000 [ 489.377618][ T30] audit: type=1326 audit(1753188344.681:6758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f223438e5ab code=0x7ffc0000 [ 489.414088][ T30] audit: type=1326 audit(1753188344.681:6759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10982 comm="syz.2.1314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 489.447142][ T9793] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 489.486109][ T9793] usb 3-1: USB disconnect, device number 79 [ 506.838107][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.845276][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 547.095631][T11039] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.324430][ T9793] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 547.474744][ T9793] usb 2-1: Using ep0 maxpacket: 8 [ 547.490607][ T9793] usb 2-1: unable to get BOS descriptor or descriptor too short [ 547.507524][ T9793] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 251, changing to 7 [ 547.519041][ T9309] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 547.532895][ T9793] usb 2-1: config 1 interface 1 has no altsetting 0 [ 547.539936][ T10] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 547.554186][ T9312] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 547.566861][ T9793] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 547.587518][ T9793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.604484][ T9793] usb 2-1: Product: syz [ 547.608942][ T9793] usb 2-1: Manufacturer: syz [ 547.613621][ T9793] usb 2-1: SerialNumber: syz [ 547.684075][ T10] usb 4-1: device descriptor read/64, error -71 [ 547.699691][ T9309] usb 5-1: config 0 has no interfaces? [ 547.710513][ T9309] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 547.722231][ T9309] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.731485][ T9309] usb 5-1: Product: syz [ 547.736223][ T9312] usb 1-1: Using ep0 maxpacket: 32 [ 547.742111][ T9309] usb 5-1: Manufacturer: syz [ 547.748618][ T9309] usb 5-1: SerialNumber: syz [ 547.753887][ T9312] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 547.765298][ T9312] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 547.774799][ T9312] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 547.786806][ T9312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 547.798252][ T9309] usb 5-1: config 0 descriptor?? [ 547.840194][ T9312] usb 1-1: config 0 descriptor?? [ 547.924598][ T10] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 548.038908][T11034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.050540][T11034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.064144][ T10] usb 4-1: device descriptor read/64, error -71 [ 548.176491][ T10] usb usb4-port1: attempt power cycle [ 548.249457][ T9793] usb 2-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 548.260053][ T9793] usb 2-1: 2:1 : sample bitwidth 46 in over sample bytes 2 [ 548.286998][ T9793] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 548.336275][ T9793] usb 2-1: USB disconnect, device number 83 [ 548.384817][ T9312] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 548.475950][T11046] udevd[11046]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 548.524813][ T10] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 548.555724][ T9312] usb 3-1: Using ep0 maxpacket: 16 [ 548.565326][ T9312] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 548.579226][ T10] usb 4-1: device descriptor read/8, error -71 [ 548.588111][ T9312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 548.604782][ T9312] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 548.614405][ T9312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.623136][ T9312] usb 3-1: Product: syz [ 548.627966][ T9312] usb 3-1: Manufacturer: syz [ 548.632707][ T9312] usb 3-1: SerialNumber: syz [ 548.648924][ T9312] usb 3-1: config 0 descriptor?? [ 548.663884][ T9312] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 548.682380][ T9312] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 548.824122][ T10] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 548.866874][ T10] usb 4-1: device descriptor read/8, error -71 [ 548.949141][T11061] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 549.004522][ T10] usb usb4-port1: unable to enumerate USB device [ 549.021298][T11061] team0: entered promiscuous mode [ 549.039276][T11061] team_slave_0: entered promiscuous mode [ 549.061958][T11061] team_slave_1: entered promiscuous mode [ 549.091317][T11061] batadv1: entered promiscuous mode [ 549.774636][ T9312] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 549.790714][ T9312] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 549.801055][ T9312] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 549.811070][ T9312] em28xx 3-1:0.0: No AC97 audio processor [ 550.241746][ T5916] usb 5-1: USB disconnect, device number 90 [ 550.324189][ T9312] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 550.429215][ T9793] usb 1-1: USB disconnect, device number 102 [ 550.519299][ T9312] usb 2-1: Using ep0 maxpacket: 16 [ 550.560951][ T9312] usb 2-1: config 1 has an invalid descriptor of length 228, skipping remainder of the config [ 550.588281][T11085] program syz.0.1340 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 550.607562][ T9312] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 550.642158][ T9312] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 550.693881][ T9312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.702926][ T9312] usb 2-1: Product: syz [ 550.712528][T11088] netlink: 'syz.0.1340': attribute type 10 has an invalid length. [ 550.720768][ T9312] usb 2-1: Manufacturer: syz [ 550.725947][T11088] hsr0: left allmulticast mode [ 550.731504][ T9312] usb 2-1: SerialNumber: syz [ 550.768629][T11088] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 550.780869][T11088] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 550.817629][T11088] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 550.955618][ T9312] usb 2-1: 0:2 : does not exist [ 551.005677][ T5917] usb 3-1: USB disconnect, device number 80 [ 551.012926][ T5917] em28xx 3-1:0.0: Disconnecting em28xx [ 551.039903][ T5917] em28xx 3-1:0.0: Freeing device [ 551.167289][ T9312] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 551.280459][ T9312] usb 2-1: USB disconnect, device number 84 [ 551.328017][T11094] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 551.420806][T11046] udevd[11046]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.692923][T11085] syz.0.1340 (11085): drop_caches: 2 [ 551.758534][T11099] loop3: detected capacity change from 0 to 1 [ 551.822946][T11099] loop3: [POWERTEC] p1 p2 p3 [ 551.854330][T11099] loop3: p1 size 536870912 extends beyond EOD, truncated [ 551.895497][T11099] loop3: p2 size 150994944 extends beyond EOD, truncated [ 551.912325][T11099] loop3: p3 start 1886744434 is beyond EOD, truncated [ 552.485345][ T10] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 552.694452][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 552.703735][ T10] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 552.750012][ T10] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 552.804159][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 552.823340][ T10] usb 3-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.00 [ 552.867400][T11118] input: syz0 as /devices/virtual/input/input61 [ 552.884192][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.942145][ T10] usb 3-1: config 0 descriptor?? [ 553.200344][T11124] capability: warning: `syz.2.1348' uses 32-bit capabilities (legacy support in use) [ 553.246672][T11125] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1352'. [ 553.562221][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 553.584397][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 553.631398][ T10] usb 3-1: USB disconnect, device number 81 [ 553.667499][T11135] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 553.901476][T11142] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 554.351819][T11148] loop3: detected capacity change from 0 to 1 [ 554.393090][T11046] loop3: [POWERTEC] p1 p2 p3 [ 554.428438][T11046] loop3: p1 size 536870912 extends beyond EOD, truncated [ 554.437260][T11150] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.484683][T11046] loop3: p2 size 150994944 extends beyond EOD, truncated [ 554.495439][T11150] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.701651][T11046] loop3: p3 start 1886744434 is beyond EOD, truncated [ 554.713404][T11150] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.732655][T11148] loop3: [POWERTEC] p1 p2 p3 [ 554.738142][T11148] loop3: p1 size 536870912 extends beyond EOD, truncated [ 554.925283][T11150] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.943180][T11150] geneve2: entered allmulticast mode [ 554.982248][T11148] loop3: p2 size 150994944 extends beyond EOD, truncated [ 555.185318][T11148] loop3: p3 start 1886744434 is beyond EOD, truncated [ 555.333753][T11036] udevd[11036]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 555.348984][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 555.363017][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 555.363039][ T30] audit: type=1326 audit(1753188410.841:6777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11153 comm="syz.0.1360" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff2cfb8e9a9 code=0x0 [ 555.392624][ C1] vkms_vblank_simulate: vblank timer overrun [ 555.443250][T11154] FAULT_INJECTION: forcing a failure. [ 555.443250][T11154] name failslab, interval 1, probability 0, space 0, times 0 [ 555.484464][T11154] CPU: 1 UID: 0 PID: 11154 Comm: syz.4.1359 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 555.484500][T11154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 555.484516][T11154] Call Trace: [ 555.484527][T11154] [ 555.484537][T11154] dump_stack_lvl+0x189/0x250 [ 555.484573][T11154] ? __pfx____ratelimit+0x10/0x10 [ 555.484600][T11154] ? __pfx_dump_stack_lvl+0x10/0x10 [ 555.484628][T11154] ? __pfx__printk+0x10/0x10 [ 555.484667][T11154] ? __pfx___might_resched+0x10/0x10 [ 555.484692][T11154] ? fs_reclaim_acquire+0x7d/0x100 [ 555.484728][T11154] should_fail_ex+0x414/0x560 [ 555.484769][T11154] should_failslab+0xa8/0x100 [ 555.484805][T11154] __kmalloc_noprof+0xcb/0x4f0 [ 555.484837][T11154] ? io_cache_alloc_new+0x40/0x100 [ 555.484865][T11154] ? percpu_ref_get_many+0x21/0x1e0 [ 555.484904][T11154] io_cache_alloc_new+0x40/0x100 [ 555.484939][T11154] io_msg_alloc_async+0x1b2/0x2d0 [ 555.484994][T11154] io_send_zc_prep+0x42e/0xdd0 [ 555.485042][T11154] io_submit_sqes+0x90f/0x1c50 [ 555.485109][T11154] __se_sys_io_uring_enter+0x2df/0x2b20 [ 555.485159][T11154] ? ksys_write+0x1cb/0x250 [ 555.485195][T11154] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 555.485217][T11154] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 555.485253][T11154] ? __pfx_vfs_write+0x10/0x10 [ 555.485290][T11154] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 555.485324][T11154] ? __fget_files+0x3a0/0x420 [ 555.485356][T11154] ? irqentry_exit+0x74/0x90 [ 555.485382][T11154] ? lockdep_hardirqs_on+0x9c/0x150 [ 555.485422][T11154] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 555.485452][T11154] do_syscall_64+0xfa/0x3b0 [ 555.485478][T11154] ? lockdep_hardirqs_on+0x9c/0x150 [ 555.485501][T11154] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.485525][T11154] ? clear_bhb_loop+0x60/0xb0 [ 555.485554][T11154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.485578][T11154] RIP: 0033:0x7f25ac98e9a9 [ 555.485600][T11154] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 555.485622][T11154] RSP: 002b:00007f25ad841038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 555.485646][T11154] RAX: ffffffffffffffda RBX: 00007f25acbb5fa0 RCX: 00007f25ac98e9a9 [ 555.485664][T11154] RDX: 0000000000000000 RSI: 00000000000047bc RDI: 0000000000000005 [ 555.485678][T11154] RBP: 00007f25ad841090 R08: 0000000000000000 R09: 0000000000000000 [ 555.485692][T11154] R10: 0000000000000021 R11: 0000000000000246 R12: 0000000000000001 [ 555.485706][T11154] R13: 0000000000000000 R14: 00007f25acbb5fa0 R15: 00007f25accdfa28 [ 555.485743][T11154] [ 555.517856][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 555.626793][T11036] udevd[11036]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 555.977798][ T5917] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 556.005547][T11163] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1363'. [ 556.196543][ T5917] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 556.224564][ T5917] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 556.290363][ T5917] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 556.334623][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 556.351914][T11168] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 556.369296][ T5917] usb 1-1: SerialNumber: syz [ 556.555660][T11173] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1368'. [ 556.739636][T11175] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1369'. [ 557.085865][ T10] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 557.259224][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 557.272182][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 557.295625][ T10] usb 4-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 557.331267][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.484313][ T10] usb 4-1: config 0 descriptor?? [ 557.514750][T11180] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 558.134233][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 558.280437][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 558.346189][T11197] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1375'. [ 558.364411][ T10] usb 4-1: USB disconnect, device number 80 [ 558.398954][ T5917] usb 1-1: 0:2 : does not exist [ 558.448826][ T5917] usb 1-1: unit 255 not found! [ 558.544504][ T5917] usb 1-1: USB disconnect, device number 103 [ 558.666907][T11046] udevd[11046]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 558.939576][T11209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1379'. [ 559.099048][ T10] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 559.198012][T11213] hsr0: entered allmulticast mode [ 559.215487][T11213] bond1: left promiscuous mode [ 559.220590][T11213] bridge2: left promiscuous mode [ 559.221970][T11215] FAULT_INJECTION: forcing a failure. [ 559.221970][T11215] name failslab, interval 1, probability 0, space 0, times 0 [ 559.278924][T11215] CPU: 1 UID: 0 PID: 11215 Comm: syz.3.1381 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 559.278954][T11215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 559.278969][T11215] Call Trace: [ 559.278979][T11215] [ 559.278989][T11215] dump_stack_lvl+0x189/0x250 [ 559.279020][T11215] ? __pfx____ratelimit+0x10/0x10 [ 559.279045][T11215] ? __pfx_dump_stack_lvl+0x10/0x10 [ 559.279071][T11215] ? __pfx__printk+0x10/0x10 [ 559.279106][T11215] ? __pfx___might_resched+0x10/0x10 [ 559.279131][T11215] ? fs_reclaim_acquire+0x7d/0x100 [ 559.279158][T11215] should_fail_ex+0x414/0x560 [ 559.279187][T11215] should_failslab+0xa8/0x100 [ 559.279221][T11215] __kmalloc_noprof+0xcb/0x4f0 [ 559.279249][T11215] ? kfree+0x4d/0x440 [ 559.279274][T11215] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 559.279308][T11215] tomoyo_realpath_from_path+0xe3/0x5d0 [ 559.279337][T11215] ? tomoyo_domain+0xd9/0x130 [ 559.279370][T11215] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 559.279392][T11215] tomoyo_path_number_perm+0x1e8/0x5a0 [ 559.279417][T11215] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 559.279458][T11215] ? __lock_acquire+0xab9/0xd20 [ 559.279507][T11215] ? __fget_files+0x2a/0x420 [ 559.279530][T11215] ? __fget_files+0x2a/0x420 [ 559.279549][T11215] ? __fget_files+0x3a0/0x420 [ 559.279567][T11215] ? __fget_files+0x2a/0x420 [ 559.279591][T11215] security_file_ioctl+0xcb/0x2d0 [ 559.279627][T11215] __se_sys_ioctl+0x47/0x170 [ 559.279657][T11215] do_syscall_64+0xfa/0x3b0 [ 559.279681][T11215] ? lockdep_hardirqs_on+0x9c/0x150 [ 559.279704][T11215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.279725][T11215] ? clear_bhb_loop+0x60/0xb0 [ 559.279763][T11215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.279784][T11215] RIP: 0033:0x7f1e8eb8e9a9 [ 559.279804][T11215] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 559.279822][T11215] RSP: 002b:00007f1e8fa99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 559.279844][T11215] RAX: ffffffffffffffda RBX: 00007f1e8edb5fa0 RCX: 00007f1e8eb8e9a9 [ 559.279860][T11215] RDX: 0000200000002dc0 RSI: 0000000000002285 RDI: 0000000000000003 [ 559.279874][T11215] RBP: 00007f1e8fa99090 R08: 0000000000000000 R09: 0000000000000000 [ 559.279887][T11215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.279898][T11215] R13: 0000000000000000 R14: 00007f1e8edb5fa0 R15: 00007f1e8eedfa28 [ 559.279931][T11215] [ 559.280076][T11215] ERROR: Out of memory at tomoyo_realpath_from_path. [ 559.552450][T11213] bond2: entered allmulticast mode [ 559.567604][T11213] vcan1: entered allmulticast mode [ 559.610228][T11213] syztnl0: entered allmulticast mode [ 559.663688][T11213] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.673105][T11213] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.683213][T11213] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.697913][T11213] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.837231][T11224] random: crng reseeded on system resumption [ 560.212311][T11238] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 560.545577][T11246] bridge9: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 560.564121][T11246] bridge9: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 561.702508][T11253] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1391'. [ 561.796834][ T10] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 562.044241][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 562.063474][ T10] usb 2-1: config index 0 descriptor too short (expected 213, got 92) [ 562.074508][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.100736][ T10] usb 2-1: config 0 has no interfaces? [ 562.126722][T11251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.181422][T11251] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.633788][T11268] FAULT_INJECTION: forcing a failure. [ 562.633788][T11268] name failslab, interval 1, probability 0, space 0, times 0 [ 562.673415][T11268] CPU: 1 UID: 0 PID: 11268 Comm: syz.0.1394 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 562.673447][T11268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 562.673461][T11268] Call Trace: [ 562.673472][T11268] [ 562.673482][T11268] dump_stack_lvl+0x189/0x250 [ 562.673513][T11268] ? __pfx____ratelimit+0x10/0x10 [ 562.673538][T11268] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.673564][T11268] ? __pfx__printk+0x10/0x10 [ 562.673596][T11268] ? __pfx___might_resched+0x10/0x10 [ 562.673621][T11268] ? fs_reclaim_acquire+0x7d/0x100 [ 562.673647][T11268] should_fail_ex+0x414/0x560 [ 562.673668][T11268] should_failslab+0xa8/0x100 [ 562.673691][T11268] __kmalloc_noprof+0xcb/0x4f0 [ 562.673721][T11268] ? tomoyo_encode+0x28b/0x550 [ 562.673752][T11268] tomoyo_encode+0x28b/0x550 [ 562.673783][T11268] tomoyo_realpath_from_path+0x58d/0x5d0 [ 562.673816][T11268] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 562.673831][T11268] tomoyo_path_number_perm+0x1e8/0x5a0 [ 562.673849][T11268] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 562.673889][T11268] ? __lock_acquire+0xab9/0xd20 [ 562.673932][T11268] ? __fget_files+0x2a/0x420 [ 562.673958][T11268] ? __fget_files+0x2a/0x420 [ 562.673975][T11268] ? __fget_files+0x3a0/0x420 [ 562.673992][T11268] ? __fget_files+0x2a/0x420 [ 562.674015][T11268] security_file_ioctl+0xcb/0x2d0 [ 562.674050][T11268] __se_sys_ioctl+0x47/0x170 [ 562.674079][T11268] do_syscall_64+0xfa/0x3b0 [ 562.674103][T11268] ? lockdep_hardirqs_on+0x9c/0x150 [ 562.674119][T11268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.674135][T11268] ? clear_bhb_loop+0x60/0xb0 [ 562.674153][T11268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.674175][T11268] RIP: 0033:0x7ff2cfb8e9a9 [ 562.674195][T11268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.674212][T11268] RSP: 002b:00007ff2cd9f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 562.674234][T11268] RAX: ffffffffffffffda RBX: 00007ff2cfdb5fa0 RCX: 00007ff2cfb8e9a9 [ 562.674249][T11268] RDX: 0000200000002dc0 RSI: 0000000000002285 RDI: 0000000000000003 [ 562.674261][T11268] RBP: 00007ff2cd9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 562.674271][T11268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.674280][T11268] R13: 0000000000000000 R14: 00007ff2cfdb5fa0 R15: 00007ff2cfedfa28 [ 562.674303][T11268] [ 562.984045][T11268] ERROR: Out of memory at tomoyo_realpath_from_path. [ 563.045909][ T10] usb 2-1: string descriptor 0 read error: -71 [ 563.052538][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 563.221338][T11270] loop3: detected capacity change from 0 to 1 [ 563.234190][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.254649][ T10] usb 2-1: config 0 descriptor?? [ 563.260135][ T10] usb 2-1: can't set config #0, error -71 [ 563.270101][ T10] usb 2-1: USB disconnect, device number 85 [ 563.307986][T11270] loop3: [POWERTEC] p1 p2 p3 [ 563.334353][T11270] loop3: p1 size 536870912 extends beyond EOD, truncated [ 563.380080][T11270] loop3: p2 size 150994944 extends beyond EOD, truncated [ 563.405870][T11270] loop3: p3 start 1886744434 is beyond EOD, truncated [ 563.571454][T11036] udevd[11036]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 563.577868][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 563.781570][T11284] fuse: Unknown parameter '000000000000000000030000000000000000000000300000000000000000000003' [ 564.303641][T11297] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1402'. [ 564.320237][T11299] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1403'. [ 564.567382][T11306] FAULT_INJECTION: forcing a failure. [ 564.567382][T11306] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 564.595340][T11306] CPU: 1 UID: 0 PID: 11306 Comm: syz.0.1406 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 564.595372][T11306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 564.595387][T11306] Call Trace: [ 564.595396][T11306] [ 564.595406][T11306] dump_stack_lvl+0x189/0x250 [ 564.595438][T11306] ? __pfx____ratelimit+0x10/0x10 [ 564.595462][T11306] ? __pfx_dump_stack_lvl+0x10/0x10 [ 564.595488][T11306] ? __pfx__printk+0x10/0x10 [ 564.595516][T11306] ? __might_fault+0xb0/0x130 [ 564.595558][T11306] should_fail_ex+0x414/0x560 [ 564.595587][T11306] _copy_from_user+0x2d/0xb0 [ 564.595618][T11306] get_sg_io_hdr+0xe2/0x820 [ 564.595640][T11306] ? _raw_write_unlock_irqrestore+0x85/0x110 [ 564.595664][T11306] ? lockdep_hardirqs_on+0x9c/0x150 [ 564.595692][T11306] ? __pfx_get_sg_io_hdr+0x10/0x10 [ 564.595724][T11306] ? sg_add_request+0x62e/0x690 [ 564.595758][T11306] sg_new_write+0x139/0x7b0 [ 564.595791][T11306] ? __pfx___might_resched+0x10/0x10 [ 564.595818][T11306] ? __pfx_sg_new_write+0x10/0x10 [ 564.595882][T11306] ? __lock_acquire+0xab9/0xd20 [ 564.595906][T11306] sg_ioctl+0x11af/0x2230 [ 564.595945][T11306] ? __pfx_sg_ioctl+0x10/0x10 [ 564.595975][T11306] ? __fget_files+0x2a/0x420 [ 564.595998][T11306] ? __fget_files+0x2a/0x420 [ 564.596016][T11306] ? __fget_files+0x3a0/0x420 [ 564.596033][T11306] ? __fget_files+0x2a/0x420 [ 564.596056][T11306] ? bpf_lsm_file_ioctl+0x9/0x20 [ 564.596083][T11306] ? __pfx_sg_ioctl+0x10/0x10 [ 564.596112][T11306] __se_sys_ioctl+0xfc/0x170 [ 564.596141][T11306] do_syscall_64+0xfa/0x3b0 [ 564.596164][T11306] ? lockdep_hardirqs_on+0x9c/0x150 [ 564.596186][T11306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.596208][T11306] ? clear_bhb_loop+0x60/0xb0 [ 564.596233][T11306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.596265][T11306] RIP: 0033:0x7ff2cfb8e9a9 [ 564.596284][T11306] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 564.596302][T11306] RSP: 002b:00007ff2cd9f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 564.596325][T11306] RAX: ffffffffffffffda RBX: 00007ff2cfdb5fa0 RCX: 00007ff2cfb8e9a9 [ 564.596341][T11306] RDX: 0000200000002dc0 RSI: 0000000000002285 RDI: 0000000000000003 [ 564.596354][T11306] RBP: 00007ff2cd9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 564.596367][T11306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 564.596379][T11306] R13: 0000000000000000 R14: 00007ff2cfdb5fa0 R15: 00007ff2cfedfa28 [ 564.596411][T11306] [ 564.858016][ C1] vkms_vblank_simulate: vblank timer overrun [ 564.934458][ T9297] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 565.174748][ T9297] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 565.196311][ T9297] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 565.210775][ T9297] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 565.237250][ T9297] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 565.274054][ T9297] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 565.309396][ T9297] usb 4-1: config 0 descriptor?? [ 565.585313][T11317] loop3: detected capacity change from 0 to 1 [ 565.596791][T11317] loop3: [POWERTEC] p1 p2 p3 [ 565.696724][T11317] loop3: p1 size 536870912 extends beyond EOD, truncated [ 565.732087][T11317] loop3: p2 size 150994944 extends beyond EOD, truncated [ 565.743378][T11317] loop3: p3 start 1886744434 is beyond EOD, truncated [ 565.871558][T11318] block device autoloading is deprecated and will be removed. [ 566.113852][ T9297] plantronics 0003:047F:FFFF.0011: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 566.277532][T11056] udevd[11056]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 566.297655][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 566.734154][ T10] usb 2-1: new full-speed USB device number 86 using dummy_hcd [ 566.858726][T11332] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 566.869143][T11332] bridge3: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 566.955055][ T10] usb 2-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 566.964720][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.985645][ T10] usb 2-1: config 0 descriptor?? [ 567.009968][ T10] ums-realtek 2-1:0.0: USB Mass Storage device detected [ 567.264345][ T5916] usb 4-1: reset high-speed USB device number 81 using dummy_hcd [ 567.464094][ T5916] usb 4-1: device descriptor read/64, error -32 [ 567.701310][ T30] audit: type=1326 audit(1753188423.181:6778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 567.710860][T11337] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1412'. [ 567.750878][T11337] netlink: 'syz.4.1412': attribute type 2 has an invalid length. [ 567.754626][ T5916] usb 4-1: reset high-speed USB device number 81 using dummy_hcd [ 567.814323][ T30] audit: type=1326 audit(1753188423.181:6779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 567.851500][T11337] : entered promiscuous mode [ 567.854174][ T10] usb 2-1: USB disconnect, device number 86 [ 567.954521][ T5916] usb 4-1: device descriptor read/64, error -32 [ 568.018866][ T30] audit: type=1326 audit(1753188423.181:6780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.216120][ T30] audit: type=1326 audit(1753188423.181:6781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.286895][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.286895][ T30] audit: type=1326 audit(1753188423.181:6782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.286945][ T30] audit: type=1326 audit(1753188423.181:6783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.327700][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.359266][ T30] audit: type=1326 audit(1753188423.181:6784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=297 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.386628][ T30] audit: type=1326 audit(1753188423.181:6785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.418842][ T30] audit: type=1326 audit(1753188423.181:6786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.496388][ T30] audit: type=1326 audit(1753188423.181:6787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11336 comm="syz.4.1412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f25ac98e9a9 code=0x7ffc0000 [ 568.546192][ T10] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 568.648376][T11349] fuse: Unknown parameter 'group_i' [ 568.699548][ T10] usb 5-1: device descriptor read/64, error -71 [ 568.814966][T11351] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1417'. [ 568.887347][ T9297] usb 4-1: USB disconnect, device number 81 [ 568.984319][ T10] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 569.191870][T11362] kvm: kvm [11361]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0x2008080f8 [ 569.243138][ T10] usb 5-1: device descriptor read/64, error -71 [ 569.268598][T11365] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 569.281268][T11365] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 569.447209][ T10] usb usb5-port1: attempt power cycle [ 569.572228][T11370] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 569.888630][ T10] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 570.039352][ T10] usb 5-1: device descriptor read/8, error -71 [ 570.348945][T11380] hub 9-0:1.0: USB hub found [ 570.354550][ T10] usb 5-1: new full-speed USB device number 94 using dummy_hcd [ 570.396018][ T10] usb 5-1: device descriptor read/8, error -71 [ 570.403084][T11380] hub 9-0:1.0: 1 port detected [ 570.554909][ T10] usb usb5-port1: unable to enumerate USB device [ 571.207194][T11390] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1427'. [ 571.396382][ T9297] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 571.585747][ T9297] usb 1-1: Using ep0 maxpacket: 16 [ 571.610847][ T9297] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.654043][ T9297] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.685420][ T9297] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 571.718218][ T9297] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.747244][ T9297] usb 1-1: config 0 descriptor?? [ 572.021921][T11404] bridge11: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 572.032837][T11404] bridge11: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 572.176484][T11408] netlink: 186232 bytes leftover after parsing attributes in process `syz.2.1431'. [ 572.300809][ T9297] usbhid 1-1:0.0: can't add hid device: -71 [ 572.308090][ T9297] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 572.331031][ T9297] usb 1-1: USB disconnect, device number 104 [ 572.483431][T11417] tipc: Enabled bearer , priority 10 [ 572.577803][T11417] tipc: Enabled bearer , priority 0 [ 572.734183][ T5916] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 572.954670][ T5916] usb 3-1: Using ep0 maxpacket: 16 [ 572.966342][ T5916] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 573.026826][ T5916] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 573.105354][ T5916] usb 3-1: too many endpoints for config 1 interface 1 altsetting 48: 49, using maximum allowed: 30 [ 573.131963][ T5916] usb 3-1: config 1 interface 1 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 49 [ 573.176908][ T5916] usb 3-1: config 1 interface 1 has no altsetting 0 [ 573.204852][ T5917] usb 1-1: new full-speed USB device number 105 using dummy_hcd [ 573.376274][ T5916] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 573.386647][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.405971][ T5917] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 573.415966][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.444093][ T5916] usb 3-1: Product: syz [ 573.448733][ T5917] usb 1-1: Product: syz [ 573.459143][ T5916] usb 3-1: Manufacturer: syz [ 573.466349][ T5917] usb 1-1: Manufacturer: syz [ 573.475750][ T5916] usb 3-1: SerialNumber: syz [ 573.480712][ T5917] usb 1-1: SerialNumber: syz [ 573.571113][ T5917] usb 1-1: config 0 descriptor?? [ 573.580141][ T9295] tipc: Node number set to 3542952735 [ 573.657494][ T5916] usb 3-1: selecting invalid altsetting 1 [ 573.665728][ T5916] usb 3-1: selecting invalid altsetting 0 [ 573.719411][ T5916] usb 3-1: selecting invalid altsetting 0 [ 573.729825][ T5916] cdc_ncm 3-1:1.0: bind() failure [ 573.929972][ T5916] usb 3-1: selecting invalid altsetting 0 [ 574.016526][ T5916] usbtest 3-1:1.1: probe with driver usbtest failed with error -22 [ 574.160343][ T5917] airspy 1-1:0.0: Board ID: 00 [ 574.165447][ T5917] airspy 1-1:0.0: Firmware version: [ 574.265138][T11437] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 574.327262][ T5916] usb 3-1: USB disconnect, device number 83 [ 575.165738][ T5917] airspy 1-1:0.0: usb_control_msg() failed -71 request 10 [ 575.176137][ T5917] airspy 1-1:0.0: Registered as swradio24 [ 575.181993][ T5917] airspy 1-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 575.265214][ T5917] usb 1-1: USB disconnect, device number 105 [ 575.619880][T11451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1439'. [ 576.105800][T11456] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1440'. [ 576.310356][T11464] x_tables: duplicate underflow at hook 2 [ 576.594738][ T5916] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 576.784042][ T5916] usb 5-1: Using ep0 maxpacket: 32 [ 576.802508][ T5916] usb 5-1: config 2 has an invalid interface number: 117 but max is 0 [ 576.843555][ T5916] usb 5-1: config 2 has no interface number 0 [ 576.862872][ T5916] usb 5-1: config 2 interface 117 has no altsetting 0 [ 576.873827][ T5916] usb 5-1: New USB device found, idVendor=0781, idProduct=0100, bcdDevice= 1.00 [ 576.885389][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.894046][ T5916] usb 5-1: Product: syz [ 576.898382][ T5916] usb 5-1: Manufacturer: syz [ 576.903087][ T5916] usb 5-1: SerialNumber: syz [ 576.916450][ T5916] usb-storage 5-1:2.117: USB Mass Storage device detected [ 576.932636][ T5916] usb-storage 5-1:2.117: Quirks match for vid 0781 pid 0100: 1 [ 577.104292][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 577.104308][ T30] audit: type=1326 audit(1753188432.561:6815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.133833][ C1] vkms_vblank_simulate: vblank timer overrun [ 577.262220][ T5916] usb 5-1: USB disconnect, device number 95 [ 577.301135][ T30] audit: type=1326 audit(1753188432.561:6816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.328199][ T30] audit: type=1326 audit(1753188432.561:6817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.350928][ C1] vkms_vblank_simulate: vblank timer overrun [ 577.408914][ T30] audit: type=1326 audit(1753188432.561:6818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.431817][ C1] vkms_vblank_simulate: vblank timer overrun [ 577.638653][T11486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1447'. [ 577.720359][T11486] block device autoloading is deprecated and will be removed. [ 577.736043][T11486] syz.2.1447: attempt to access beyond end of device [ 577.736043][T11486] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 577.753696][ T30] audit: type=1326 audit(1753188432.561:6819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.810889][ T30] audit: type=1326 audit(1753188432.561:6820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 577.833524][ C1] vkms_vblank_simulate: vblank timer overrun [ 578.332880][T11498] fuse: Bad value for 'fd' [ 578.338661][T11498] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 578.438572][T11500] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1450'. [ 578.563651][ T30] audit: type=1326 audit(1753188432.561:6821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 578.577899][T11503] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1452'. [ 578.690179][T11499] bridge12: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 578.700454][ T30] audit: type=1326 audit(1753188432.561:6822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 578.737247][ T30] audit: type=1326 audit(1753188432.561:6823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 578.762817][ C1] vkms_vblank_simulate: vblank timer overrun [ 578.775775][ T30] audit: type=1326 audit(1753188432.561:6824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11474 comm="syz.2.1445" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f223438e9a9 code=0x7ffc0000 [ 578.799068][ C1] vkms_vblank_simulate: vblank timer overrun [ 578.855073][T11499] bridge12: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 579.824322][ T5916] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 580.061616][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 580.080881][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 580.101605][ T5916] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 580.125839][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.149720][T11526] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1457'. [ 580.159231][T11526] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1457'. [ 580.176916][ T5916] usb 5-1: config 0 descriptor?? [ 580.792434][ T10] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 580.810405][ T5916] cm6533_jd 0003:0D8C:0022.0012: unknown main item tag 0x0 [ 580.823076][ T5916] cm6533_jd 0003:0D8C:0022.0012: unknown main item tag 0x0 [ 580.849200][ T5916] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0D8C:0022.0012/input/input62 [ 580.954943][T11520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 580.991783][T11520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 581.000128][ T5916] cm6533_jd 0003:0D8C:0022.0012: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.4-1/input0 [ 581.165234][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 581.283099][ T10] usb 4-1: config 0 has an invalid interface number: 145 but max is 0 [ 581.354861][ T10] usb 4-1: config 0 has no interface number 0 [ 581.415680][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 581.460790][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.493181][ T10] usb 4-1: Product: syz [ 581.506442][ T10] usb 4-1: Manufacturer: syz [ 581.526921][ T10] usb 4-1: SerialNumber: syz [ 581.638139][ T10] usb 4-1: config 0 descriptor?? [ 581.712571][ T10] hub 4-1:0.145: bad descriptor, ignoring hub [ 581.948079][ T10] hub 4-1:0.145: probe with driver hub failed with error -5 [ 582.115901][ T9312] usb 5-1: reset high-speed USB device number 96 using dummy_hcd [ 582.127062][ T10] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.145/input/input63 [ 582.242918][ T10] input: failed to attach handler mousedev to device input63, error: -2 [ 583.087229][T11550] netlink: 'syz.0.1462': attribute type 29 has an invalid length. [ 583.346395][ T9793] usb 5-1: USB disconnect, device number 96 [ 584.051496][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 584.051520][ T30] audit: type=1326 audit(1753188439.521:6828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 584.464185][ T30] audit: type=1326 audit(1753188439.531:6829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 584.700608][ T30] audit: type=1326 audit(1753188439.531:6830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 584.798833][ T30] audit: type=1326 audit(1753188439.531:6831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.055945][ T9312] usb 4-1: USB disconnect, device number 82 [ 585.087308][ T30] audit: type=1326 audit(1753188439.531:6832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.192599][ T30] audit: type=1326 audit(1753188439.531:6833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.354286][ T30] audit: type=1326 audit(1753188439.571:6834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.642968][ T30] audit: type=1326 audit(1753188439.571:6835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.724633][ T30] audit: type=1326 audit(1753188439.571:6836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 585.903220][T11562] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1466'. [ 585.912945][ T30] audit: type=1326 audit(1753188439.651:6837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11564 comm="syz.1.1467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4df18e9a9 code=0x7ffc0000 [ 586.643135][T11597] pim6reg1: entered promiscuous mode [ 586.676758][T11597] pim6reg1: entered allmulticast mode [ 587.407864][T11613] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1478'. [ 588.026879][ T5916] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 588.293326][ T5916] usb 5-1: Using ep0 maxpacket: 8 [ 588.318694][ T5916] usb 5-1: unable to get BOS descriptor or descriptor too short [ 588.346574][ T5916] usb 5-1: config 7 has an invalid interface number: 194 but max is 0 [ 588.444211][ T5916] usb 5-1: config 7 has no interface number 0 [ 588.467341][ T5916] usb 5-1: New USB device found, idVendor=2019, idProduct=ed18, bcdDevice=ca.21 [ 588.500943][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.523765][ T5916] usb 5-1: Product: syz [ 588.532574][ T5916] usb 5-1: Manufacturer: syz [ 588.546264][T11634] tipc: Enabled bearer , priority 0 [ 588.561001][ T5916] usb 5-1: SerialNumber: syz [ 588.598666][T11636] syzkaller0: entered promiscuous mode [ 588.607172][T11636] syzkaller0: entered allmulticast mode [ 588.662693][T11634] tipc: Resetting bearer [ 588.674501][T11634] syzkaller0: tun_net_xmit 90 [ 588.694054][ T9312] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 588.749495][T11631] tipc: Resetting bearer [ 588.790397][T11631] tipc: Disabling bearer [ 588.822027][ T5916] usb 5-1: USB disconnect, device number 97 [ 588.888823][ T9312] usb 1-1: config 1 interface 0 altsetting 75 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 588.917242][ T9312] usb 1-1: config 1 interface 0 has no altsetting 0 [ 588.938059][ T9312] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 588.961480][ T9312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.005327][ T9312] usb 1-1: Product: 旎椰彯沄⯞㝸뎳믮胂졍햤䲷倱ꑸ酦獘̹飣뢐έ倾甀槜ꌴ횃 [ 589.064093][ T9312] usb 1-1: Manufacturer: 튍舑훦縯怊뫽⯠獫㟩ⶒ鞻ㆈ⺌ტጘő蠚帑墨㱂친茶鋘蔛뛴縚彅⦖뀁齥⿴㫉㰢탦⽥ᶨ撿 [ 589.134634][ T9312] usb 1-1: SerialNumber: 䭢ç搛繱삎ᡕₖ砍맇֠璆郭⢰〯噓胵㶙䑸摠㤍樭߉夰촜濽耥顉菈轴洺蜖堈ꉐ辗뜷京ꃇ틩壮ﺲዿ읯Rࠑ燚ꢋɐꡖ踦ឲ躊㣧砨圂㱓脂兾뀛ﰜ耍됙ṽㆩ鎻奝廇ﴒᒂ칂㤪뽏 傽埫㯲啒㤂௻앯Ⴞ䝹譪傝圎躊仇✿⣊ [ 589.164835][ C0] vkms_vblank_simulate: vblank timer overrun [ 589.229413][T11632] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 589.608270][ T10] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 589.648835][ T9312] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 589.788379][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 589.819887][ T10] usb 3-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.10 [ 589.829993][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.851568][ T10] usb 3-1: Product: syz [ 589.856705][ T10] usb 3-1: Manufacturer: syz [ 589.856729][ T10] usb 3-1: SerialNumber: syz [ 589.879824][ T5916] usb 1-1: USB disconnect, device number 106 [ 589.879865][ T10] usb 3-1: config 0 descriptor?? [ 589.918833][ T10] go7007 3-1:0.0: probe with driver go7007 failed with error -12 [ 590.024498][ T5917] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 590.107688][T11646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1489'. [ 590.130921][T11646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 590.140900][T11646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 590.176199][ T5917] usb 2-1: Using ep0 maxpacket: 16 [ 590.183484][ T5917] usb 2-1: config 0 has an invalid interface number: 250 but max is 0 [ 590.192212][ T5917] usb 2-1: config 0 has no interface number 0 [ 590.198873][ T5917] usb 2-1: config 0 interface 250 altsetting 1 bulk endpoint 0x4 has invalid maxpacket 1023 [ 590.209951][ T5917] usb 2-1: config 0 interface 250 altsetting 1 has a duplicate endpoint with address 0x4, skipping [ 590.221745][ T5917] usb 2-1: config 0 interface 250 altsetting 1 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 590.235763][ T5917] usb 2-1: config 0 interface 250 has no altsetting 0 [ 590.248734][ T5917] usb 2-1: New USB device found, idVendor=04e8, idProduct=689a, bcdDevice=88.04 [ 590.260513][ T5917] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.270714][ T5917] usb 2-1: Product: syz [ 590.277590][ T5917] usb 2-1: Manufacturer: syz [ 590.283410][ T5917] usb 2-1: SerialNumber: syz [ 590.291688][ T5917] usb 2-1: config 0 descriptor?? [ 590.299842][T11661] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 590.304252][ T10] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 590.460706][T11667] openvswitch: netlink: Missing key (keys=40, expected=100) [ 590.482155][ T10] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 590.503211][ T10] usb 5-1: config 0 has no interface number 0 [ 590.522534][ T10] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 590.523150][T11661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1493'. [ 590.540374][ T10] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 590.563525][ T10] usb 5-1: config 0 interface 255 has no altsetting 0 [ 590.594194][ T10] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 590.622173][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.644686][ T5917] usb 2-1: USB disconnect, device number 87 [ 590.660778][ T10] usb 5-1: config 0 descriptor?? [ 590.689988][ T10] ums-realtek 5-1:0.255: USB Mass Storage device detected [ 590.710861][T11674] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1497'. [ 590.881830][ T5917] usb 5-1: USB disconnect, device number 98 [ 591.164496][ T9295] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 591.327113][ T9295] usb 2-1: device descriptor read/64, error -71 [ 591.584253][ T9295] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 591.724621][ T9295] usb 2-1: device descriptor read/64, error -71 [ 591.754075][ T10] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 591.845388][ T9295] usb usb2-port1: attempt power cycle [ 591.934510][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 591.945254][ T10] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 591.955875][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.964583][ T10] usb 5-1: Product: syz [ 591.969427][ T10] usb 5-1: Manufacturer: syz [ 591.975782][ T10] usb 5-1: SerialNumber: syz [ 591.988411][ T10] usb 5-1: config 0 descriptor?? [ 592.200804][ T10] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 592.230262][ T9295] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 592.280079][ T9295] usb 2-1: device descriptor read/8, error -71 [ 592.301615][ T5916] usb 3-1: USB disconnect, device number 84 [ 592.501684][T11700] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 592.630905][ T9295] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 592.756893][ T9295] usb 2-1: device descriptor read/8, error -71 [ 592.994157][ T5916] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 592.995726][ T10] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 593.124953][ T9295] usb usb2-port1: unable to enumerate USB device [ 593.218508][ T5916] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 593.232261][ T5916] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 593.245919][ T5916] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 593.309907][ T5916] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 593.319650][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.328094][ T5916] usb 3-1: Product: syz [ 593.332743][ T5916] usb 3-1: Manufacturer: syz [ 593.369391][ T5916] usb 3-1: SerialNumber: syz [ 593.396368][ T5916] cdc_ncm 3-1:1.0: skipping garbage [ 593.404045][ T5916] cdc_ncm 3-1:1.0: skipping garbage [ 593.449967][ T5916] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 593.460569][ T5916] cdc_ncm 3-1:1.0: bind() failure [ 594.146310][T11708] loop3: detected capacity change from 0 to 1 [ 594.169150][T11046] loop3: [POWERTEC] p1 p2 p3 [ 594.177444][T11046] loop3: p1 size 536870912 extends beyond EOD, truncated [ 594.209550][T11046] loop3: p2 size 150994944 extends beyond EOD, truncated [ 594.225203][T11046] loop3: p3 start 1886744434 is beyond EOD, truncated [ 594.240115][T11708] loop3: [POWERTEC] p1 p2 p3 [ 594.250953][T11708] loop3: p1 size 536870912 extends beyond EOD, truncated [ 594.286342][T11708] loop3: p2 size 150994944 extends beyond EOD, truncated [ 594.309643][T11708] loop3: p3 start 1886744434 is beyond EOD, truncated [ 594.455497][T11036] udevd[11036]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 594.488849][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 594.534542][ T9312] usb 5-1: USB disconnect, device number 99 [ 594.596924][T11036] udevd[11036]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 594.659417][T11046] udevd[11046]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 595.757099][ T5916] usb 3-1: USB disconnect, device number 85 [ 596.074061][ T9312] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 596.175685][ T10] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 596.256824][ T9312] usb 4-1: Using ep0 maxpacket: 8 [ 596.272187][ T9312] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 596.288841][ T9312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.351972][ T10] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 596.370321][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.408967][ T9312] pvrusb2: Hardware description: Terratec Grabster AV400 [ 596.421378][ T10] usb 5-1: Product: syz [ 596.431938][ T9312] pvrusb2: ********** [ 596.440701][ T10] usb 5-1: Manufacturer: syz [ 596.448954][ T9312] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 596.460847][ T10] usb 5-1: SerialNumber: syz [ 596.521060][ T10] usb 5-1: config 0 descriptor?? [ 596.529496][ T9312] pvrusb2: Important functionality might not be entirely working. [ 596.613174][ T9312] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 596.661750][ T9312] pvrusb2: ********** [ 596.678284][ T2342] pvrusb2: Invalid write control endpoint [ 596.703623][ T9312] usb 4-1: USB disconnect, device number 83 [ 596.970703][ T2342] pvrusb2: Invalid write control endpoint [ 597.014925][ T2342] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 597.034128][ T10] airspy 5-1:0.0: Board ID: 00 [ 597.039336][ T10] airspy 5-1:0.0: Firmware version: [ 597.067461][ T2342] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 597.075775][ T9793] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 597.085669][ T2342] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 597.128218][ T2342] pvrusb2: Device being rendered inoperable [ 597.185866][ T2342] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 597.236358][ T9793] usb 2-1: config 0 interface 0 altsetting 251 has an invalid descriptor for endpoint zero, skipping [ 597.248116][ T2342] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 597.258298][ T9793] usb 2-1: config 0 interface 0 has no altsetting 0 [ 597.277866][ T9793] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 597.293326][ T2342] pvrusb2: Attached sub-driver cx25840 [ 597.299389][ T9793] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 597.320587][ T2342] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 597.333175][ T9793] usb 2-1: Product: syz [ 597.341625][ T9793] usb 2-1: Manufacturer: syz [ 597.349927][ T2342] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 597.363461][ T9793] usb 2-1: SerialNumber: syz [ 597.375725][ T9793] usb 2-1: config 0 descriptor?? [ 597.564650][ T9295] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 597.664072][ T10] airspy 5-1:0.0: usb_control_msg() failed -71 request 12 [ 597.705422][ T9295] usb 1-1: device descriptor read/64, error -71 [ 597.714519][ T10] airspy 5-1:0.0: Registered as swradio24 [ 597.727754][ T9793] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 597.736880][ T10] airspy 5-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 597.762385][ T10] usb 5-1: USB disconnect, device number 100 [ 597.832518][T11046] udevd[11046]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 598.014168][ T9312] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 598.044815][ T9295] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 598.155404][ T10] usb 2-1: USB disconnect, device number 92 [ 598.194123][ T9295] usb 1-1: device descriptor read/64, error -71 [ 598.206824][ T9312] usb 4-1: config 4 has 0 interfaces, different from the descriptor's value: 1 [ 598.303529][ T9312] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 598.343589][ T9312] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.359566][ T9295] usb usb1-port1: attempt power cycle [ 598.636398][ T9312] usb 4-1: Product: syz [ 598.640659][ T9312] usb 4-1: Manufacturer: syz [ 598.707396][ T9312] usb 4-1: SerialNumber: syz [ 598.734362][ T9295] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 598.798823][ T9295] usb 1-1: device descriptor read/8, error -71 [ 599.089611][ T9295] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 599.697127][ T9295] usb 1-1: device descriptor read/8, error -71 [ 599.834916][T11763] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 600.053199][ T9295] usb usb1-port1: unable to enumerate USB device [ 600.840706][T11776] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 600.923110][T11778] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 601.308000][ T9312] usb 4-1: USB disconnect, device number 84 [ 602.054528][ T9295] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 602.244075][ T9295] usb 3-1: Using ep0 maxpacket: 32 [ 602.270130][ T9295] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 602.315957][ T9295] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 603.086166][ T9295] usb 3-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 603.126583][ T9295] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.574708][ T9295] usb 3-1: config 0 descriptor?? [ 603.596217][ T9295] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 603.810033][T11790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.821510][T11790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.012687][ T9295] usb 3-1: USB disconnect, device number 86 [ 604.221628][T11814] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1531'. [ 604.309248][ T9297] usb 1-1: new low-speed USB device number 111 using dummy_hcd [ 604.466791][ T9297] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 604.480677][ T9297] usb 1-1: config 0 has no interface number 0 [ 604.494485][ T9295] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 604.507738][ T9297] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 604.525439][ T9297] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 604.541348][ T9297] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 604.559837][ T9297] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 604.580064][ T9297] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 604.591956][ T9297] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 604.611842][ T9297] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 604.623497][ T9297] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.641469][ T9297] usb 1-1: config 0 descriptor?? [ 604.650033][T11810] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 604.661567][T11810] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 604.694072][ T9295] usb 3-1: Using ep0 maxpacket: 16 [ 604.703513][ T9297] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 604.720182][ T9295] usb 3-1: config index 0 descriptor too short (expected 16456, got 72) [ 604.732014][ T9295] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 604.749951][ T9295] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 604.761409][ T9295] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 604.770636][ T9295] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 604.780270][ T9295] usb 3-1: config 0 has no interface number 0 [ 604.788545][ T9295] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 604.821878][ T9295] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 604.855321][ T9295] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 604.884446][ T9295] usb 3-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 604.903875][T11810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.913598][T11810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.924315][ T9295] usb 3-1: config 0 interface 125 has no altsetting 0 [ 604.931158][ T9295] usb 3-1: config 0 interface 125 has no altsetting 2 [ 604.941441][ T9295] usb 3-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 605.026282][ T9295] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.037673][ T9295] usb 3-1: Product: syz [ 605.042085][ T9295] usb 3-1: Manufacturer: syz [ 605.047587][ T9295] usb 3-1: SerialNumber: syz [ 605.058897][ T9295] usb 3-1: config 0 descriptor?? [ 605.071392][ T9295] usb 3-1: selecting invalid altsetting 2 [ 605.224305][ T9297] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 605.475360][T11829] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 605.512398][ T9297] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 605.524663][ T9297] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 605.577311][ T9297] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 605.607440][ T9297] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.929831][T11837] syz.1.1536: attempt to access beyond end of device [ 605.929831][T11837] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 606.058598][T11822] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 606.066505][ C1] usb 3-1: async_complete: urb error -71 [ 606.072572][ C1] usb 3-1: async_complete: urb error -71 [ 606.078468][ C1] usb 3-1: async_complete: urb error -71 [ 606.084289][ C1] usb 3-1: async_complete: urb error -71 [ 606.107097][ T9295] get_1284_register: usb error -71 [ 606.113179][ T9295] uss720 3-1:0.125: probe with driver uss720 failed with error -71 [ 606.157215][ T9297] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 606.174404][ T9295] usb 3-1: USB disconnect, device number 87 [ 606.900522][ T9793] usb 1-1: USB disconnect, device number 111 [ 606.946088][ T9793] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 607.121731][ T9297] usb 5-1: USB disconnect, device number 101 [ 607.807599][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 607.807616][ T30] audit: type=1400 audit(1753188463.291:6895): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A21D01A0B978D2F2F262D2A83D1 pid=11848 comm="syz.4.1541" [ 607.913127][T11849] pimreg: entered allmulticast mode [ 607.930310][T11849] pimreg: left allmulticast mode [ 608.224434][ T9793] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 608.435874][ T9793] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 608.484152][ T9793] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 608.593370][ T9793] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 608.639598][ T9793] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 608.691839][ T9793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.717299][ T9793] usb 2-1: Product: syz [ 608.721565][ T9793] usb 2-1: Manufacturer: syz [ 608.750410][ T9793] usb 2-1: SerialNumber: syz [ 608.767060][ T9793] usb 2-1: config 0 descriptor?? [ 608.783059][T11851] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 608.794359][T11851] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 608.844956][ T9793] usb 2-1: ucan: probing device on interface #0 [ 609.037927][ T9312] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 609.195241][ T9312] usb 5-1: Using ep0 maxpacket: 16 [ 609.215801][ T9312] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 609.270955][ T9793] usb 2-1: ucan: device reported invalid device info [ 609.301600][ T9312] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 609.335275][ T9793] usb 2-1: ucan: probe failed; try to update the device firmware [ 609.382110][ T9312] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 609.527090][T11851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.538413][T11851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.602445][ T9312] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 609.659493][ T9312] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 609.669514][ T9312] usb 5-1: config 0 has no interface number 0 [ 609.693652][ T9793] usb 2-1: USB disconnect, device number 93 [ 609.713350][ T9312] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 609.731950][ T9312] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 609.779545][ T9312] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 609.864212][ T9312] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 609.884785][ T9312] usb 5-1: config 0 interface 125 has no altsetting 0 [ 609.920268][ T9312] usb 5-1: config 0 interface 125 has no altsetting 2 [ 609.945327][ T9312] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 609.961293][ T9312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.971293][ T9312] usb 5-1: Product: syz [ 609.978858][ T9312] usb 5-1: Manufacturer: syz [ 609.984123][ T9312] usb 5-1: SerialNumber: syz [ 609.991179][T11881] ptrace attach of "./syz-executor exec"[5856] was attempted by "./syz-executor exec"[11881] [ 610.029453][ T9312] usb 5-1: config 0 descriptor?? [ 610.056747][ T9312] usb 5-1: selecting invalid altsetting 2 [ 610.083582][T11881] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 610.090466][T11881] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 610.104657][T11881] vhci_hcd vhci_hcd.0: Device attached [ 610.174584][T11885] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 610.521847][T11882] vhci_hcd: connection closed [ 610.594169][ T9295] vhci_hcd: vhci_device speed not set [ 610.594562][ T6899] vhci_hcd: stop threads [ 610.622634][ T6899] vhci_hcd: release socket [ 610.631861][ T6899] vhci_hcd: disconnect device [ 610.664221][ T9295] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 610.672762][ T9295] usb 37-1: enqueue for inactive port 0 [ 610.785992][ T9295] vhci_hcd: vhci_device speed not set [ 610.838114][T11891] fuse: Bad value for 'fd' [ 610.846893][T11891] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 610.916300][T11894] FAULT_INJECTION: forcing a failure. [ 610.916300][T11894] name failslab, interval 1, probability 0, space 0, times 0 [ 610.962087][T11894] CPU: 0 UID: 0 PID: 11894 Comm: syz.1.1550 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 610.962116][T11894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 610.962130][T11894] Call Trace: [ 610.962138][T11894] [ 610.962146][T11894] dump_stack_lvl+0x189/0x250 [ 610.962173][T11894] ? __pfx____ratelimit+0x10/0x10 [ 610.962192][T11894] ? __pfx_dump_stack_lvl+0x10/0x10 [ 610.962211][T11894] ? __pfx__printk+0x10/0x10 [ 610.962236][T11894] ? __pfx___might_resched+0x10/0x10 [ 610.962253][T11894] ? fs_reclaim_acquire+0x7d/0x100 [ 610.962272][T11894] should_fail_ex+0x414/0x560 [ 610.962292][T11894] should_failslab+0xa8/0x100 [ 610.962317][T11894] __kmalloc_noprof+0xcb/0x4f0 [ 610.962337][T11894] ? kfree+0x4d/0x440 [ 610.962354][T11894] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 610.962377][T11894] tomoyo_realpath_from_path+0xe3/0x5d0 [ 610.962398][T11894] ? tomoyo_domain+0xd9/0x130 [ 610.962421][T11894] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 610.962436][T11894] tomoyo_path_number_perm+0x1e8/0x5a0 [ 610.962460][T11894] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 610.962488][T11894] ? __lock_acquire+0xab9/0xd20 [ 610.962520][T11894] ? __fget_files+0x2a/0x420 [ 610.962538][T11894] ? __fget_files+0x2a/0x420 [ 610.962550][T11894] ? __fget_files+0x3a0/0x420 [ 610.962563][T11894] ? __fget_files+0x2a/0x420 [ 610.962579][T11894] security_file_ioctl+0xcb/0x2d0 [ 610.962604][T11894] __se_sys_ioctl+0x47/0x170 [ 610.962625][T11894] do_syscall_64+0xfa/0x3b0 [ 610.962644][T11894] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.962658][T11894] ? asm_sysvec_call_function_single+0x1a/0x20 [ 610.962674][T11894] ? clear_bhb_loop+0x60/0xb0 [ 610.962692][T11894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.962706][T11894] RIP: 0033:0x7fc4df18e9a9 [ 610.962721][T11894] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 610.962735][T11894] RSP: 002b:00007fc4e00cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 610.962751][T11894] RAX: ffffffffffffffda RBX: 00007fc4df3b5fa0 RCX: 00007fc4df18e9a9 [ 610.962763][T11894] RDX: 0000200000000380 RSI: 00000000c0845657 RDI: 0000000000000003 [ 610.962773][T11894] RBP: 00007fc4e00cd090 R08: 0000000000000000 R09: 0000000000000000 [ 610.962783][T11894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.962792][T11894] R13: 0000000000000000 R14: 00007fc4df3b5fa0 R15: 00007fc4df4dfa28 [ 610.962814][T11894] [ 610.962847][T11894] ERROR: Out of memory at tomoyo_realpath_from_path. [ 611.239041][ C0] usb 5-1: async_complete: urb error -71 [ 611.244903][ C0] usb 5-1: async_complete: urb error -71 [ 611.250951][ C0] usb 5-1: async_complete: urb error -71 [ 611.256870][ C0] usb 5-1: async_complete: urb error -71 [ 611.294072][ T9312] get_1284_register: usb error -71 [ 611.304138][ T9312] uss720 5-1:0.125: probe with driver uss720 failed with error -71 [ 611.320333][T11896] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1552'. [ 611.360544][ T9312] usb 5-1: USB disconnect, device number 102 [ 612.019062][T11907] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 612.897927][T11922] fuse: Bad value for 'group_id' [ 612.903308][T11922] fuse: Bad value for 'group_id' [ 612.914999][T11922] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1556'. [ 613.224049][ T9312] usb 5-1: new full-speed USB device number 103 using dummy_hcd [ 613.540779][ T9312] usb 5-1: no configurations [ 613.554126][ T9312] usb 5-1: can't read configurations, error -22 [ 613.834161][ T9312] usb 5-1: new full-speed USB device number 104 using dummy_hcd [ 614.054900][ T9312] usb 5-1: no configurations [ 614.059564][ T9312] usb 5-1: can't read configurations, error -22 [ 614.294193][ T9312] usb usb5-port1: attempt power cycle [ 614.743288][T11941] fuse: Bad value for 'fd' [ 614.749928][T11941] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 614.794196][ T9312] usb 5-1: new full-speed USB device number 105 using dummy_hcd [ 614.814147][ T5936] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 614.840804][ T9312] usb 5-1: no configurations [ 614.845842][ T9312] usb 5-1: can't read configurations, error -22 [ 614.954387][ T9295] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 614.987771][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 615.004289][ T9312] usb 5-1: new full-speed USB device number 106 using dummy_hcd [ 615.025392][ T5936] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 615.038451][ T5936] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 615.054302][ T9312] usb 5-1: no configurations [ 615.064146][ T9312] usb 5-1: can't read configurations, error -22 [ 615.069414][T11947] syzkaller1: entered promiscuous mode [ 615.081248][T11947] syzkaller1: entered allmulticast mode [ 615.081958][ T9312] usb usb5-port1: unable to enumerate USB device [ 615.094192][ T9295] usb 2-1: device descriptor read/64, error -71 [ 615.109973][ T5936] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 615.143161][ T5936] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 615.162734][ T5936] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.200310][ T5936] usb 1-1: config 0 descriptor?? [ 615.344396][ T9295] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 615.352503][ T5916] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 615.504061][ T9295] usb 2-1: device descriptor read/64, error -71 [ 615.514061][ T5916] usb 3-1: device descriptor read/64, error -71 [ 615.611801][ T5936] HID 045e:07da: Invalid code 65791 type 1 [ 615.634403][ T9295] usb usb2-port1: attempt power cycle [ 615.644757][ T5936] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0013/input/input65 [ 615.681286][ T5936] microsoft 0003:045E:07DA.0013: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 615.774261][ T5916] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 615.831668][T11935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 615.862341][ T9793] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 615.875856][T11957] binder: BINDER_SET_CONTEXT_MGR already set [ 615.882027][T11957] binder: 11956:11957 ioctl 4018620d 200000000040 returned -16 [ 615.893926][T11935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 615.924800][ T5916] usb 3-1: device descriptor read/64, error -71 [ 616.014101][ T9295] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 616.045929][ T5936] usb 1-1: USB disconnect, device number 112 [ 616.049510][ T5916] usb usb3-port1: attempt power cycle [ 616.104038][ T9793] usb 4-1: Using ep0 maxpacket: 16 [ 616.104711][ T9295] usb 2-1: device descriptor read/8, error -71 [ 616.121094][ T9793] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 616.162132][ T9793] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 616.204979][ T9793] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 616.229715][ T9793] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 616.244660][ T9793] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 616.264647][ T9793] usb 4-1: config 0 has no interface number 0 [ 616.284419][ T9793] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 616.317165][ T9793] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 616.357787][ T9793] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 616.387217][ T9793] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 616.404255][ T9295] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 616.424446][ T5916] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 616.465104][ T9295] usb 2-1: device descriptor read/8, error -71 [ 616.475674][ T9793] usb 4-1: config 0 interface 125 has no altsetting 0 [ 616.475791][ T5916] usb 3-1: device descriptor read/8, error -71 [ 616.482690][ T9793] usb 4-1: config 0 interface 125 has no altsetting 2 [ 616.511239][ T9793] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 616.574517][ T9295] usb usb2-port1: unable to enumerate USB device [ 616.614160][ T9793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.652613][ T9793] usb 4-1: Product: syz [ 616.657632][ T9793] usb 4-1: Manufacturer: syz [ 616.664389][ T9793] usb 4-1: SerialNumber: syz [ 616.703756][ T9793] usb 4-1: config 0 descriptor?? [ 616.712593][ T9793] usb 4-1: selecting invalid altsetting 2 [ 616.794158][ T5916] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 616.877350][ T5916] usb 3-1: device descriptor read/8, error -71 [ 616.988848][T11979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1572'. [ 617.014439][ T5916] usb usb3-port1: unable to enumerate USB device [ 617.216911][ C0] usb 4-1: async_complete: urb error -71 [ 617.223073][ C0] usb 4-1: async_complete: urb error -71 [ 617.228855][ C0] usb 4-1: async_complete: urb error -71 [ 617.234804][ C0] usb 4-1: async_complete: urb error -71 [ 617.283780][ T9793] get_1284_register: usb error -71 [ 617.294528][ T9793] uss720 4-1:0.125: probe with driver uss720 failed with error -71 [ 617.335533][T11983] fuse: Bad value for 'fd' [ 617.347140][ T9793] usb 4-1: USB disconnect, device number 85 [ 617.361936][T11983] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 617.621791][T11987] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 618.534403][T11995] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 619.128101][T12004] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1579'. [ 619.193755][T12008] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1579'. [ 619.203422][ T9793] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 619.424222][ T9793] usb 4-1: Using ep0 maxpacket: 8 [ 619.438329][ T9793] usb 4-1: New USB device found, idVendor=0458, idProduct=7003, bcdDevice=7a.1a [ 619.462289][ T9793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.571941][ T9793] usb 4-1: Product: syz [ 619.582066][ T9793] usb 4-1: Manufacturer: syz [ 619.602314][ T9793] usb 4-1: SerialNumber: syz [ 619.635128][ T9793] usb 4-1: config 0 descriptor?? [ 619.673740][ T9793] gspca_main: sn9c2028-2.14.0 probing 0458:7003 [ 619.764456][ T9312] usb 2-1: new low-speed USB device number 98 using dummy_hcd [ 620.127581][ T9312] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 620.135712][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 620.189978][ T9312] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 620.204351][T12021] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1582'. [ 620.214080][ T9793] gspca_sn9c2028: read1 error -110 [ 620.245666][ T9793] gspca_sn9c2028: read1 error -32 [ 620.264081][ T9793] gspca_sn9c2028: read1 error -32 [ 620.319493][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 620.361208][ T9793] sn9c2028 4-1:0.0: probe with driver sn9c2028 failed with error -32 [ 620.407732][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 620.475316][ T9312] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 620.486135][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 620.540028][ T9312] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 620.557757][T12028] [ 620.560168][T12028] ============================================ [ 620.566529][T12028] WARNING: possible recursive locking detected [ 620.572724][T12028] 6.16.0-rc7-syzkaller #0 Not tainted [ 620.578219][T12028] -------------------------------------------- [ 620.584578][T12028] syz.2.1584/12028 is trying to acquire lock: [ 620.591355][T12028] ffff888079118d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: __netdev_update_features+0xcb1/0x1a20 [ 620.602458][T12028] [ 620.602458][T12028] but task is already holding lock: [ 620.609841][T12028] ffff888079118d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 620.619812][T12028] and the lock comparison function returns 0: [ 620.625979][T12028] [ 620.625979][T12028] other info that might help us debug this: [ 620.634482][T12028] Possible unsafe locking scenario: [ 620.634482][T12028] [ 620.642211][T12028] CPU0 [ 620.645527][T12028] ---- [ 620.648921][T12028] lock(&dev_instance_lock_key#20); [ 620.654584][T12028] lock(&dev_instance_lock_key#20); [ 620.660174][T12028] [ 620.660174][T12028] *** DEADLOCK *** [ 620.660174][T12028] [ 620.668418][T12028] May be due to missing lock nesting notation [ 620.668418][T12028] [ 620.676947][T12028] 2 locks held by syz.2.1584/12028: [ 620.682354][T12028] #0: ffffffff8f51c108 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1d0/0x1990 [ 620.692076][T12028] #1: ffff888079118d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 620.702496][T12028] [ 620.702496][T12028] stack backtrace: [ 620.708600][T12028] CPU: 1 UID: 0 PID: 12028 Comm: syz.2.1584 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 620.708626][T12028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 620.708639][T12028] Call Trace: [ 620.708855][T12028] [ 620.708867][T12028] dump_stack_lvl+0x189/0x250 [ 620.708896][T12028] ? __pfx_dump_stack_lvl+0x10/0x10 [ 620.708917][T12028] ? __pfx__printk+0x10/0x10 [ 620.708942][T12028] ? print_lock_name+0xde/0x100 [ 620.708966][T12028] print_deadlock_bug+0x28b/0x2a0 [ 620.708989][T12028] validate_chain+0x1a3f/0x2140 [ 620.709020][T12028] __lock_acquire+0xab9/0xd20 [ 620.709039][T12028] ? __netdev_update_features+0xcb1/0x1a20 [ 620.709056][T12028] lock_acquire+0x120/0x360 [ 620.709073][T12028] ? __netdev_update_features+0xcb1/0x1a20 [ 620.709095][T12028] __mutex_lock+0x182/0xe80 [ 620.709115][T12028] ? __netdev_update_features+0xcb1/0x1a20 [ 620.709133][T12028] ? unwind_get_return_address+0x4d/0x90 [ 620.709155][T12028] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 620.709179][T12028] ? arch_stack_walk+0xfc/0x150 [ 620.709202][T12028] ? __netdev_update_features+0xcb1/0x1a20 [ 620.709220][T12028] ? __pfx___mutex_lock+0x10/0x10 [ 620.709240][T12028] ? bond_fix_features+0x191/0x1d0 [ 620.709270][T12028] __netdev_update_features+0xcb1/0x1a20 [ 620.709287][T12028] ? __kasan_slab_free+0x62/0x70 [ 620.709310][T12028] ? kmem_cache_free+0x18f/0x400 [ 620.709333][T12028] ? netlink_broadcast_filtered+0x103e/0x1140 [ 620.709361][T12028] ? __pfx___netdev_update_features+0x10/0x10 [ 620.709379][T12028] ? do_raw_spin_lock+0x121/0x290 [ 620.709409][T12028] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 620.709428][T12028] ? lockdep_hardirqs_on+0x9c/0x150 [ 620.709451][T12028] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 620.709471][T12028] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 620.709495][T12028] netdev_change_features+0x72/0xd0 [ 620.709512][T12028] ? __pfx_netdev_change_features+0x10/0x10 [ 620.709529][T12028] ? cfg80211_netdev_notifier_call+0x1ea/0x13c0 [ 620.709556][T12028] ? consume_skb+0xce/0xf0 [ 620.709579][T12028] ? netlink_broadcast_filtered+0x10c8/0x1140 [ 620.709601][T12028] ? netif_set_tso_max_size+0x10e/0x1d0 [ 620.709636][T12028] bond_compute_features+0x615/0x680 [ 620.709660][T12028] ? __pfx_bond_compute_features+0x10/0x10 [ 620.709796][T12028] bond_netdev_event+0x72e/0xe80 [ 620.709833][T12028] ? __pfx_bond_netdev_event+0x10/0x10 [ 620.709858][T12028] ? inetdev_event+0x464/0x15b0 [ 620.709879][T12028] ? igmp_netdev_event+0x7c/0x770 [ 620.709898][T12028] notifier_call_chain+0x1b3/0x3e0 [ 620.709923][T12028] netdev_features_change+0x85/0xc0 [ 620.709945][T12028] ? __pfx_netdev_features_change+0x10/0x10 [ 620.709973][T12028] ? security_capable+0x7e/0x2e0 [ 620.709994][T12028] dev_ethtool+0x1520/0x1990 [ 620.710016][T12028] ? __pfx_dev_ethtool+0x10/0x10 [ 620.710039][T12028] ? dev_load+0x21/0x1f0 [ 620.710060][T12028] dev_ioctl+0x392/0x1150 [ 620.710082][T12028] sock_do_ioctl+0x22c/0x300 [ 620.710102][T12028] ? __pfx_sock_do_ioctl+0x10/0x10 [ 620.710120][T12028] ? __lock_acquire+0xab9/0xd20 [ 620.710143][T12028] sock_ioctl+0x576/0x790 [ 620.710161][T12028] ? __pfx_sock_ioctl+0x10/0x10 [ 620.710179][T12028] ? __fget_files+0x2a/0x420 [ 620.710194][T12028] ? __fget_files+0x3a0/0x420 [ 620.710207][T12028] ? __fget_files+0x2a/0x420 [ 620.710223][T12028] ? bpf_lsm_file_ioctl+0x9/0x20 [ 620.710243][T12028] ? __pfx_sock_ioctl+0x10/0x10 [ 620.710260][T12028] __se_sys_ioctl+0xfc/0x170 [ 620.710281][T12028] do_syscall_64+0xfa/0x3b0 [ 620.710300][T12028] ? lockdep_hardirqs_on+0x9c/0x150 [ 620.710317][T12028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.710335][T12028] ? clear_bhb_loop+0x60/0xb0 [ 620.710353][T12028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.710371][T12028] RIP: 0033:0x7f223438e9a9 [ 620.710388][T12028] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 620.710404][T12028] RSP: 002b:00007f223522f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 620.710424][T12028] RAX: ffffffffffffffda RBX: 00007f22345b5fa0 RCX: 00007f223438e9a9 [ 620.710438][T12028] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000007 [ 620.710450][T12028] RBP: 00007f2234410d69 R08: 0000000000000000 R09: 0000000000000000 [ 620.710462][T12028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 620.710472][T12028] R13: 0000000000000000 R14: 00007f22345b5fa0 R15: 00007f22346dfa28 [ 620.710491][T12028] [ 621.154684][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 621.169625][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 621.182180][ T9312] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 621.189877][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 621.200784][ T9312] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 621.218469][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 621.230449][ T9312] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 621.250941][ T9312] usb 2-1: string descriptor 0 read error: -22 [ 621.257551][ T9312] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 621.271350][ T9312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.448352][ T9312] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 621.651379][ T5916] usb 4-1: USB disconnect, device number 86 [ 629.716545][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.723182][ T1300] ieee802154 phy1 wpan1: encryption failed: -22