last executing test programs: 13.273053157s ago: executing program 0 (id=1274): openat$mice(0xffffff9c, &(0x7f00000002c0), 0x212240) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(0x0, 0x1, 0x122c42) socket$kcm(0x10, 0x6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) r2 = openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="d60400007d0000000524010000000000000000000000000000000000000000000c40000000000000000000000000000000002e00046e6f645a3dbf640237fc6225ffffff8005000000000000ff03ff92e91600059b65712c93cb3db6c231d119aaa139007002007dfa673effeb09b5351f5bde054000000000187b82d9b56928fbbf0b00002b595fcb14034354b9fd9ef196a51cd5157adc8106b494e13500cf60372d61cceab8c88641eb93b4ccf6002ab87bfc012796093f68305c4d2220837e0108e2e748501c51484ba02f109caaf91509a25500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cdb80e8d40700000037009d036f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0c41f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa75f8246bcc42eaa8c631c0c500959a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238593aed3b42ee7cac07de09d1d68a60333a882467d2b31aafb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fecdfd529f382066664c0fb4e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae122e6105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fc200000030e4ee2bfc7f8050851143e5161acd47150acbaf743822dfe203b108d37e914dc1e53e234c509eca4107a1712caa9da53d051c36884c79182661f3ca36bcdbfbbd267109f8319d8dd5c07099eb1b11030655f562694f61743d19421b4a19ef8b8b4ce9c993c7d6cb300c4e657a4e50a35b5cc16b8c161a8e3df9036bbcf28adcd19a6c4c291709aee5ab3e5bc5ae29f475e4d24408b5167d0faf5fc1566b705c8b60afa8aca42f7e0469188a0ef062ca18e38f9ee10ac77d2b7eb9d60ea79fdb556411e59dfbd8dbb8a2a6622ebcf84c696fa4da21bad2320d0d68e9bf4346f0686119a39e400395c8f2825ea069ae0e143bd1a44179ed8e3cea0b5e9a19cc7ffa500fa41b6c8049bde45827d54ec901d27ad125056889b3336b3f06838c5b667ae22efe3bc15b825f7fbce48027281cf9fe8fc21fc77c243de26705310eb81cf74de0293192a13f6ad057de61fd8aba8ef4439bc06a45b2b03162515a23433afeb52aedb5ab6f334653380515f779f35dc8a78c37772492a2284c21d21356d473f00f85137c7bf0636f757d3528869b3f007735cff85c9d978bf55dcc26d62d25e308f08827a91ff47bec92f8e91e7908665400aa4e39b35986239d5c7b9492c5bb26bc55b55b49ed70486e6e7da38c208450f9f79e1b4100000000000000000000000000ae51ceba44f717f0a07749239b5d08f8c5c0ad7951e0a7c7f3db8dfd3f8657258a6c04f32d57ad2873de45fa98b0f8267917ff9b3e9c0d74a5aca206fe29e0c1039f22553c2747425d831030782ee78f8ba35de318c53f094f925cc9782e94b6c870a487678bfae745dff268bda7fdec873ce4fb4b8dcba0419b30449adfef724162bfb10aafcfea48a67fae7733cc3a7f1eef91be5285215eab41f6", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0], 0x4d6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000a, 0x204031, r4, 0xffffd000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) 12.549557197s ago: executing program 2 (id=1275): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r4 = socket$nl_generic(0x10, 0x3, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000004480)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000064c0)=ANY=[@ANYBLOB="7812000043000701fefffffffcdbdf25037c00000400de8060120180060dd28080f1292b4baabb53e336c927d66e7a5cd43c519737429792539bfad01db4255fe576d8accff159c4c0766fcc0cdb428e8a7395681cd8bd87ff0082ad8706d0ae19135a491a66edabd946927a79822213fcc99dcadda4eaca16997b1e19c8ca8386b7069d5aab7441b3b872d653550c22528f3cd870f1a548eb83ee8d4d3bf30400460006f7b93e4e2da0a483180f51dcf6ca51b5ac73754a4e1f1784684093cdb608a06dcddb16a603a0691cb36b1b0fc57bec22d13112f8f7d7cd79b80b7c375aa581c2c46c1050d23fc4546e7451c5ccb3af0ab0638602853cc39866c46f47850faf62b2b2edabdcd92174fb166fddbb48100cd580040c3c803e4cfb7d9476fd1d017eb9078f952d3a75d9075aee263002bc6c280818617f6dcc2d78d250345c4fd77cbd992708c4f49d3fb9c2fb76c51fc58553fd98e8482cfde2b5a608bedea16547c8d27bcc78e686def41941c14b305fcde542427c2fb93c1ac6a6669be34ff484f55767bff599f60d37a7cd78d95ebf7a4098b10c18690c0cefc2a9a1efa5051da49af7331acc405a32475211ebb9ac0e2d01bf4e4eb37365d885e3d042043a3a6a4f3b97f59be5453c761e04050788576d7ff57b6b1622fad2e28de53938dcf5b7888aca7d960eb7a907d99ef298f51ddd8a34d1a04f07af254fcaa3aa6cf97264846af78e7ed0cd5d2dd8f21fe0cebe2a41353574ef247b8360d7dcc2a017ed347ed4feea7ccad5810a61ee02f4a7c8e3c79e53ace72f04baf226922f0959eb64b10d85b5724a5ebe64c72de9618db7c302d6eee5b6639601a89ce629445f379c2ab3c0070225b0574e53b12f82fd0aa201b30d820e7cd329be88ddc820c2aaaacda2b8b0e2a8cd5385d0f204008272a705955d01857cc235656635b7e017c1450b4d8c76174b2af9ee1d57c6e662dd847e9ffe3977e201650c9167e072386fae38e715617093734bb6b8306b17fe0640e7671187e21b20af0bfd3fb81aa588060a960aafc6d401a20895238342f4376aebb044758ac0de70c58ffd4d2cded2cb27f15a52105da8a4bcb7bb12fe135c2ee8371098eb567a65eca228df5e984c63f36521919918c7af690f4175c9bec13186c650466f4594d0abdf9eebbcce1010165cf38ee361521367911cb907561a79d449d60cf1b973c4829afdbd372a0d0208d115155a41b1a3dedde92af0ed3085e9b5d750464f212decc550cf3101b7123297e147f7e7832e18e4b9df848ceab3c22e22257d0f20a0a4b92d42dc7c3f0bcf0d59519fc4358431db2c547c666bbfddf496b874fa01d001adfbf82b2d2aaf004a17e4c055d61ba7cedc98403f1eb1f0b517cf9e8a5919b1529c805f9cf35da7a75cab7ef053c87d83d79d7895e521b717af74bcd2c4c34caa85c9886099d2621fcb10b5e4f225c2d77ab7fa3b0cd48a763f0ec676352e888cfac04d397eab697f2dac7e3092f183f0a72f68b506cc596ed037b493eaa93c4f497a52bf764abb5143e75426ef9ca949d137e1daab9b45e8fc43959286a2dd0a3c89b279bb9fe3ccd854ddbf17a19c74b9dd8bf5544e373d460439d6c5117aba9f8a41dd21af5ae8a0541a1cd02b8fdac74576fae47fb08543c877fca17654aa14c33970f19cc048e49470dbce8567d2a38ecf944042e1bdf310b536c5de21180570b4b40395729efb99de24514f23b3dd7ef636cf2c630dcc2561937f94a48496fd5aeaeaeb54a965f9776cdedfeaa4579c02d143f9f304a9e1274026b82eb23bb7b539dbf06f448dc6bfe6ccb2e1a3706b2c66e51771605942f2b74affb72ab8edef6ae945bb9fd7afa139c1ece6b9f712be537966137b0710c79ee09eefc3a8c2d4f1bb1062631e970cb536f33f60d28c6f892a61fb00c6cea73396b52ba797fe16b3a5d38c9f3a0da03e374259991d3b9d0ea7a3d6f465c3ab58250343c4541775d85947b358cedf1d00852e21bc306948030fa876aa2e0f9aafec7b0b2dc68413870bfbdba4142729ca0f080871631b1954e9c6e59755d54ee49f501f658fdab8dd964814f7d24e5166d9a3bb0b42f65ee539ec4b4aee42e8ff523e1574830f7fad4802c34455c40de4c297795d641a8a459eac1a76cfe209980c829917e6341942dd12064d5648a55cc458945b07b71e20f9b8e506fc01c0c1b7cd60dd9b9b985615e66189441997c9d2f1cd94c2f82d0d1bdafad36e763afa53733f833956aeb2b0210d6f2785001a665d22c6612058b912732711d7db69d078829ec42a5bed085b8c81c6107cb29a59598ca65e923a22873049ccae0083d66cc0cf54596a751bba112303a0e3f33d49a8f4eaf4bccd7ca5b2b6848f837308aac27d6b368229be4dcbf9b9928236894b96c5dc65a75ebf2350e3d8e7a9b9b06ced1345fa1594d5f3cd93beec329565853cc4d9431bcf0c2bce865afb0b241778535e5b9584d4809594d5eb9f095e", @ANYRES32=r5, @ANYRES32=r2, @ANYRESOCT=r1, @ANYBLOB="3e01df80a71e90c6248fb12169650a2de67dc323b6ccc8eb16651ed476ba9780e1d2c2688a6741d88208004c00ac14143765291bd7f9fd8d443cce76adb9b9ac7151f0c584066a042cbeb9d47ed924e9c5cb22c1430f39510df2144e5e60", @ANYRES32=r5, @ANYBLOB="040072800000e7001a9045667fa271496429f8e7a77fbcb00259affb8c6142ddc20520b86c63a9523c0b65a29902700154d8b130e4006b3c0f6615e80000004c087699f56395fdd4e8241103e88ef2f4cae4ee39da13cce6c3ec7e1343f544e864cc867590b79b18b50050b1472ac7d5a93e5aff8ace43ee99de4677351ac632e03dde751d5bf7620320ec9e0bfacc78aa2cbbf60b76d29a17c3dd87f7b449911604722ee9a93e7160c1eaf0a4b0fd06f913cbff8e53d2268bad86b25f583b96350ee3598bf689c6640e97c316b9f58fe0ebcb572ff889046d53f2dd9190ebf4dcb5043edf47443cc6ddf26ff9c2efdaeab37e407216d6b5281eb9f9b27599ada971a45ca55b39e091b695954c4ac96e9b06d5914bdde7607533b2ee9039bf298c691c327e230f3df54190e2cb282dbf673f06b901cacbb4da69fee21dedff5bae24f6bcd866d90506065c16c10bda4a15cf877ec29f0ae6551321dfffe6de334d9ad4facb057c17d6f0ed7f3a6ace8621b3159dffae9c"], 0x1278}, 0x1, 0x0, 0x0, 0x40881}, 0x4000) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_SREGS2(r6, 0x4140aecd, &(0x7f0000000140)={{0xe566c797b7515b9, 0xffff1000, 0xf000, 0x9, 0x7f, 0x80, 0x81, 0xff, 0xfe, 0x84, 0x0, 0xb}, {0xd000, 0x2000, 0x10, 0x3, 0x3, 0x7, 0x6, 0x6, 0x1, 0x4, 0xfa, 0x5}, {0xf000, 0x8000000, 0x4, 0x4, 0x10, 0x81, 0x4, 0x13, 0x5, 0x4, 0x92, 0x80}, {0x10000, 0xeeef0000, 0xe, 0x7, 0x1, 0x40, 0x2, 0x0, 0xfd, 0x29, 0x9, 0x9}, {0xeeee8000, 0xdddd0000, 0xe, 0x9, 0x5, 0x2, 0x3, 0xf1, 0x2, 0x6e, 0x2, 0x8}, {0x4000, 0xdddd1000, 0xe, 0x2, 0xad, 0x2, 0x5, 0x5, 0x8, 0xe, 0x6, 0xa}, {0x10000, 0x10000, 0xb, 0x0, 0xcd, 0x5, 0x5, 0x26, 0x8, 0x6, 0xff, 0x6}, {0x1, 0xf000, 0xd, 0xe, 0x13, 0x3d, 0x3, 0x0, 0x7f, 0xf, 0x0, 0x8}, {0x100000, 0x5}, {0x80a0000, 0x4}, 0xa0000003, 0x0, 0x6000, 0x21, 0x5, 0xa800, 0x8000900, 0x1, [0x6, 0x2, 0x3, 0x3]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r7, &(0x7f0000003780)=[{{0x0, 0x0, 0x0}, 0xaf}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/107, 0x6b}, {&(0x7f0000000580)=""/198, 0xc6}, {&(0x7f0000000680)=""/4090, 0xffa}, {&(0x7f0000001680)=""/129, 0x81}, {&(0x7f0000001740)=""/72, 0x48}, {&(0x7f0000000500)=""/43, 0x2b}, {&(0x7f0000000080)=""/112, 0x70}], 0x7}, 0x7}], 0x3, 0x2000, 0x0) 12.408924029s ago: executing program 3 (id=1276): r0 = memfd_create(&(0x7f0000001580)='prodM\xb0\xea\a\x06\xbe\xaen/\xce4\xb7\xc1\xef\xba!\x9d\rSt\xa24\x1dz\xd05\xe2e,\xb1\x84\xea\x91^%A\xe5\x9e\x13TdT\xc6^p\xb0#R\x04\x06\xae\xebA;X\x14\x97\xabh\xd1/\x84\x8a\x91$GY\xeb\xff\a\xb4\xf9\x1f\xf04\x03\x88\xae9\'>R^P{Vr!\xe2\x02\x00\x00\x00\x00\x00\x00\x006\x96\xffZ\\A@\x00\x00\x00\xc9\xf3Y\xb8\x89#\xa1\xb1)Dk\xeb\xa1\t\x00{u[\xbd\x9d\xf4\xbf\\\xce\x02P\xf2MY\x05^\xffj\x9c\x14\xb7\xb6v2*1>\x00 \x00\x00\x00\x00\x14C?]\x8c\xb4Y\xcf\x80\x85\xd6\x036\xc8~\x10\xbf\x90/wU\xf3\xc1\xa8\f\x00\x00\xb5M\x9a\x9dc\xaaAU\xec\xe06\xed\xe4\xfb\xdf\a\xd0lg\x13\xf9\x8b:s>\xd7s\xef\xb3\x9f#\x15)\xf9\xe10\xc7\xb262\x00\x00\x00\x00\x00\x00\x00\x00Nz\x0eu\x8f\x01\x00\x00\x00\x00\x00\x03\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\xa7/\x0f\x9b`\xa5\x98\x81a\xeev\x00\x00\x00\x00\a\x10\x00m2\xf2\xd8,\x17\xf8\x8e\xae\xc8\xad\xed<\"\x8e\n\x9d\xb13\x8d\xef\x96\xd2I\"8=tg\xdfU\xd0q\x95/f\xec\xdc\xa3\xe1[\xc0\xaa\xefz\xc9\xf4[\x00\x00\x00Q\xff}5\x94\x88\xa1\xdc\xa1g\xe0q\xc5:\xe4\xdf\x80\xb3,\xb9\xb2\xdc\x81\x9f6\x0f\x84WY\xbfSY`\xb8\a\t\xb1\x058\xa4\xc3\xbb\xf8aB:\x84\x02?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3o-GU\xb0\x00F\xb3o(aI[\xd6\x9fG\xaeI\x83\x93\x8cC\xc0#\xe0q\xd0Ex|\xdb\xa8\x16\xfe>:\t0\xfd\x8a\xc7\x84\xb5\xc7M-0A\xf0\xc95\xcc\xb6\xf6\xe8o\xfd\x882\xb3\xa8\xe1\x84i\xce\xa1\xff\x95\x80\x00T\x9c\x01\xf3\x1cLB\x94m(m\f\xbc\xebY\xa0\xf7\xf0\x9d\x10\xbd\x86\x1by\xe6\xdf\xc0\xc5\xb9\xb9\xbf\xdf~9\nC\xe9\xc5\x0e\xda\x9c(\x9b\"\xc7\x97\xfc\b\x80\x00\x00\x00\x00\x00\x00\x00\xb3 .\x9b\x89\x0f\xf8$\xdd>lU\x13EG\xbb1] \xda\x19\xc5\x9b\x15\x95\xc4\xfcw\xbb\x92\x91\xc4\xa6\x907XK\xfc\x17]\xfa\xff\'\xef\x92\x1c\xb8\x1fK\xb2o \xd1\xbd\xb2\x11+\xa3R\xefQ\xc2\xbdW\x05\xec\xb3=@\x03\xc6^\xa2\x15%\xb0\'D#\xb6Q\x8f\x82?S>\x0fP\x9cE\x92{d\xe6\x9cj1\x87\xb3\x01\xde\xd3\x84d\xf4\x134\x00\x00\x00\x00h\xaa\x15\x9a\xf7\x03\x00%\x88p\x90\xbb\x9dt\xa3\xe1\r\x8d\x94\"\x19\x8b\x17)\xea\xd5\x17\xeb\xe4\x1b\x0fBZ1\xbe\xee\xfa\x1c\xf9\xa6\x11\x94\x06\\P:\xaf\xcex\xc2\x82\x9a\x16\xfc\xa1\xf9q\x12\xe3\x1a\xdc\xb7\x12\xbba\b\xbb\xed\xb2\xd1W\xe2\x8b\x8d8}\x10W\xae\xa60k2\x03\xfa\x890\x86#\bQ\xcb)\x00]\x9e\x14\xd2\xea\x82\xa8\xb7ZG\x15r\xf1\t\x00\x00\x00 \xc1\xaf\x19?\x00\\\x91\x13\x1b8\xe1\xc3\xa4\v\x94\xbfJ\xb5\xde\x95\x82\x00]B|\xe2[%\xe3\xf0\x04\xba\xed\xdb\xf5\x7f\x9d\xfe>\xf6m$M&\x7fq]\xe4\xf6\x82\xc3\x00\xb1zg}\x99e\xa4\x19\xe9\x1a4a\xd75D-k\x84\xa6\x12+\xebk\xa1\xfek\x89\xef\x18\xc1)6\xa65\xe2D\xbe\xe1\xdfq\xdd68\xf37g\xab9m\xe7\xddO\v?\xe0\xbe}\xa9U\xc7{\xd3\x16W\xbb\xe5\xd2\x93\xfe\xa4\x9d\r$\xe91c8`\x86\xbc)\xc6\x12\x8c_x\xa8\xfa\xb5K\x03\x85\x93k\xe1\x8e\x1f)\".\xcc\'\v\xa6\x1bj\\\n\xe98yA\xd8T\x85\x80A\xcbo\x99\x99\xeb)r\x1a\xce\x18(\x185LL\xbcOeO\'\xe2\x86&\xe4\xe2\xe7~\x92\xa2\xb2\x9b\xc3\x00\x85\xce\xad\xff\x03\x00\x00\x00\x00\x00\x00\v,q\xd4\x18\xbdM\x1a\xde\xba*L\x05m6\xecH\xd0T\xb8m\xdb\b\xa6\x02\xfb\x13\xac\x91\x8a\x8d\x94\x93\x8d=\xb1\x84\x9c\x9b\xe5\xc7\xa6\xc9Q\xc1eUc\xcc\x180^\x00\x00\x00\x00\x00\x00\x00\x00\xe7]6+\\\x00\x00\x00\x00?#C.\x1dj\xd9\xc3\xdd&\x80g:N\xec\x06[\x8f\x92\xe2\xb01\xb0\xef\x10,\xde\xf3\x86D\x8b\xf7\xf1\f\xa5#w\xdaU\xa8>AH\xef\\\xf9\x8b\a\xe0\xb2\xcb\xf0\x97\b\r\xd5`\xb9\x0f?\xab\xe5\x13\x02\xc4\b\xd6\xa4\x1e\xbe\x12-}\xc5\x84\xde@\x18\x87\f\x01O\xedS\x8f\x9en,\xbce\xb2\xe4\x82v\x1c\xed\x84-s\xab\x06b\xbc\xba\xec\xa5\xc9A\x84\xd0\xe0 S\xc8\xa2\xaf\x85\v\xad\xa5\x88\xcf\xb6}`\x14\'\xea\xbfN\xac)\xa1\xe8\xb2\x9f\x112TJ\x16\x8c9\xe9\xf5\x18\x15Dd\x8a%\x04\x00\x93\x88\xe9\x18\x82]\x9e&\xfa\xaa\xfa8Z2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\xb35\x00\xfb\xac8wAph\xb4\x9d\x14\xf6\xec+f\'\xa3\xb9\xaf\x87X\xec\x13\x9c\xc5\x84\xde\x1b\x11\xe8\\}\xf81\xe6U3\xf9~\xdfD[\x1a\x02\x1f\xd2\x1as-\x9c\x01\x86\xa7\xb8\xc5\xeeOg\x99j\xedu\xafO@\x8e\xf24w\xad\x130Z&\xcb\x81\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Lo\x12\x00\xa2\xa5$9\x05O\xfe\x0e\xd2N\x98\x84\x10\x01\x89\xaa)\x118\xcd\xf8>\xab\xd9\xbd\xcfH\xa5\x8e\x14\x12\xb0OF\x80\xbb\xb6B\x80Q \x85\'w\xc8D\xf9\xfa\f1\x9e\x83I\xe5\n\xae8\xb7\f\xab#\x85Y\xeeH\x98\x84\x8c\x16)\xdcZ<\x80\xbd\x8d~\n\x88-\xa1\x97\xaf2e\xa6\'\x8aQ\x85}\xf1\rJF\f\x8c_\x01\xbe\'\v1\xccL\x0e\x05\xbdIa\x85\xb8\x14\xe0;}\xb7\x11\xb5\xfa\xeb\x13\xd3\x92\x8a\xe47\xf9\x12\xd9\xd5\x99\xf4\t\xdf\x058\xc4]\xf7\x16J\xf9\xce\xf0zG\xe6i\xf1~\xaaL\xa5\xd5\xe5L\xban?\'\x11B\xeav\xbf|\xc6\xc9>\xfc\x14\xbe7T\x00\x05\x05\x13}#\x1d\xc85*\xe7\n\xdf\xd4d\xf9k\xb1\xdcT1\xecH\xea\xe0\x1c\xe5;I\r\xf2;\xa1\xbfz0Ij\xddn\xe1U\xd6\xfd4\x98\fD\xe5f\x15\xf3\x8fr\x17\xd8/\xde\xaf(\xe1\xd3\xdfF\xbe\x88\xc6\xd3\tO \xbb0#\xb3\x99\xef\xb1\x00\x00\x00l\xc6\x8fi\x91N,|\xff<0\xe3\xd8\xe9(\xb9\x90\x9f1\x10/\x1b`W*\a\x00W\xe0kV\x02\x89%\xbe%\x8a\v\xbaI\x11Z\xed\xc4\xd6\xd7\xdf\xb9\xa2fS\x0510\xb3\xa9D\x9e\xa7\x06\xc82*m1\xa0\xb6\x91K\xe0\\\xd2\x8e\xb3\xcdn|\x1f3\x01\xee\xb8\x13\\q\xf6 \xa89\xeb\nN\xde\xbe2J\x1cu\xabA\x06S\xc5\x8e\xa1\xa8\xd2\xf2\xe1\xa1\x88 l-\xdb\xd9\x7f\xbe}\xee\x03\xc7\xad@\xcc\x10cxr\xb1\xcc\xa7\x84\xf0\xb4\xe6\xea\xaah\x12x\x91\x9bwU\x96\x85\xb6\xdd\'\xf1\a\xa6\xf25\xa0,:\x89\xfc8M:]U^\x9c\xbd\x1bAhB\x9e5\x16\x96\x11\x00$\xc0X\xf9\x15\xad\x87j\x93\x8ay\x10\xbft\xb9z\xcb\x8f\xfc\xaa\xdd\xfb{\x0e\x93\xaf\x80', 0xd) preadv2(r0, 0x0, 0x0, 0x4, 0x2, 0x31) preadv(r0, &(0x7f0000001700)=[{&(0x7f0000000440)=""/9, 0x9}, {&(0x7f0000000480)=""/41, 0x29}, {&(0x7f00000004c0)=""/107, 0x6b}, {&(0x7f0000000540)=""/194, 0xc2}, {&(0x7f0000000700)=""/4096, 0x1000}], 0x5, 0x0, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {0x80000001}}, './file0\x00'}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x198, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x561f}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x390f4136}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xcd}]}]}, @TIPC_NLA_NODE={0xb4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4b, 0x4, {'gcm(aes)\x00', 0x23, "b3e7d601ededb04794ae53f81deff077ecbba4b73a0346d84afa5729989cd1b7e51257"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3ef83d25}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "bc1a95c3c3bd7bf410de0ee78ca551cc50b15ce4c05fb3af"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xf65d}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x401}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x4008095}, 0xc000850) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005002100000000080500010004"], 0x4c}}, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000001dc0)={0x0, 0x400}, &(0x7f0000001e00)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000001e40)={r4, 0x6}, &(0x7f0000001e80)=0x8) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) utime(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x8000000000000000}) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000400)={0x0, 0x4, 0x0, 0x4c5e}) 11.887542323s ago: executing program 3 (id=1277): socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r2, 0x80, &(0x7f00000000c0)=@in6={0xa, 0x4e24, 0x200052, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x400c0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) io_uring_enter(r3, 0x3514, 0x9141, 0x69, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(0xffffffffffffffff, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x1, 0x0) 11.153038215s ago: executing program 0 (id=1278): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8040480) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, r6}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r4) sendmsg$DEVLINK_CMD_SB_POOL_GET(r4, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r7, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0xd0, r7, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x9609}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x80c}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xc}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000240), &(0x7f00000002c0)='./file0\x00', 0x8, 0x1) fsopen(0x0, 0x0) socket(0x2b, 0xa, 0x3) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1001}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r10 = dup(r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x12, r10, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 10.542293528s ago: executing program 1 (id=1279): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x9a974000) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace(0x10, r2) ptrace(0x4208, r2) r3 = syz_open_procfs(r2, 0x0) r4 = userfaultfd(0x80801) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r6 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r6, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000000240)={0x3, {"771c2e09a6afc168243d3e8ca34e208f", "45d5c22cb6cd3148b85d5dbf5f9e3413", "a9929074e915d4b883a44cd492a341be"}, 0x0, 0x4}) close_range(r4, 0xffffffffffffffff, 0x0) lseek(r3, 0x36, 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x854}, 0x0) mremap(&(0x7f00001a6000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000208000/0x2000)=nil) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 8.754709058s ago: executing program 3 (id=1281): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 8.428251641s ago: executing program 3 (id=1282): bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7fffffff}]}) setfsuid(0xffffffffffffffff) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_usb_connect$hid(0x1, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x272, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xb, 0x40, 0x4, "", [{{0x9, 0x4, 0x0, 0x10, 0x2, 0x3, 0x1, 0x2, 0xe9, {0x9, 0x21, 0xa, 0x8, 0x1, {0x22, 0x1fe}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x22, 0x8, 0x1}}}}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x68902, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x100000000000012) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="50000000100039042abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="b96b00003537a940300012800b00010065727370616e00002000028004001200050016000200000006001800080000000500170001080000"], 0x50}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) 8.12699074s ago: executing program 0 (id=1284): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000380), 0x0) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) r4 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x203f76, 0x100, 0xfffffffe, 0x1cf}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0xffffffffffffff3a, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r7, 0x0, 0x0, 0x0, 0x2000, 0x1, {0x1}}) io_uring_enter(r4, 0x3516, 0xf400, 0x0, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000140)={"4497ccf4", 0xb, 0x5, 0x0, 0x3, 0x1000006, "55000000030007000000dc7500", "1575a859", "07d7fcde", "2782914e", ["aabe8459c62224475793e8a7", "7f9ce2d2c4f4390300c1d1c8", "ce0301000c0091023be516d1", '\x00\x00k\x00\x00\x00\x00\x00\x00 \x00']}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x14) userfaultfd(0x80001) r8 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::.:\x00', 0x0) 7.991759653s ago: executing program 4 (id=1285): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x0, 0xc5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47, 0x8, 0x0, 0x0}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) syz_open_procfs$namespace(0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x203f76, 0x100, 0xfffffffe, 0x1cf}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0xffffffffffffff3a, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r6, 0x0, 0x0, 0x0, 0x2000, 0x1, {0x1}}) io_uring_enter(r3, 0x3516, 0xf400, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000018000000bfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff0000000015040000000002000f040000000000003404ffc101ed0a0065040000170000801f400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda500"], 0x0}, 0x94) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000140)={"4497ccf4", 0xb, 0x5, 0x0, 0x3, 0x1000006, "55000000030007000000dc7500", "1575a859", "07d7fcde", "2782914e", ["aabe8459c62224475793e8a7", "7f9ce2d2c4f4390300c1d1c8", "ce0301000c0091023be516d1", '\x00\x00k\x00\x00\x00\x00\x00\x00 \x00']}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x14) userfaultfd(0x80001) r7 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::.:\x00', 0x0) 7.695449034s ago: executing program 2 (id=1286): socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, 0x0) pipe2(0x0, 0x4000) vmsplice(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x5) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x3}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r1, 0x80, &(0x7f00000000c0)=@in6={0xa, 0x4e24, 0x200052, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x400c0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) io_uring_enter(r2, 0x3514, 0x9141, 0x69, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(0xffffffffffffffff, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x1, 0x0) 6.337435355s ago: executing program 1 (id=1287): socket$rxrpc(0x21, 0x2, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x305200, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x80001, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0x7, 0xb}, {0xfff2, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c9e0}, 0x4008080) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000440)) getrlimit(0x1d, 0x0) r6 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) 5.927451189s ago: executing program 2 (id=1288): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x2102, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000080)=0x2, 0x95, 0x102) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffefffff}, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000300)={0xb, @meta={0x48505356, 0x2bc7c873, 0x53d2, 0x200aca3, 0x5a2d424f}}) poll(&(0x7f0000000100), 0x0, 0x8) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto(r5, &(0x7f0000000100)="51bf7336f6cdf0ca6c13c866d6bc7b55f2d501845841bb2c078a988b7eb38f11a326083cf884920013fbae4a3a5d9c8ea7ea86669fb6212da0b5c82136d9519daeb17c9f96ad78cccef50ab4eabcafbc1a18735359cd7329816984d180735476f901401079349dfbe2e614f51a07c00544d90a594972ba60e1b497f88dcdc1e45dd28c0678d803638e7bd70a8638136e52c5e932c4111d3c917fb22583198b00707e3a2e001260cbc206759c2454", 0xae, 0x20000000, &(0x7f0000000280)=@l2tp={0x2, 0x0, @broadcast, 0x2}, 0x80) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x1a000}}, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x80000000, 0x0, 0xfffffffe, 0xb73}, 0x10) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c31dd5d659a0000001a00010000000000000000001c140000fd02000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0xc080) close_range(r0, 0xffffffffffffffff, 0x0) 5.621533787s ago: executing program 3 (id=1289): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x8800) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000380), 0x0) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) r4 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x203f76, 0x100, 0xfffffffe, 0x1cf}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0xffffffffffffff3a, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r7, 0x0, 0x0, 0x0, 0x2000, 0x1, {0x1}}) io_uring_enter(r4, 0x3516, 0xf400, 0x0, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000140)={"4497ccf4", 0xb, 0x5, 0x0, 0x3, 0x1000006, "55000000030007000000dc7500", "1575a859", "07d7fcde", "2782914e", ["aabe8459c62224475793e8a7", "7f9ce2d2c4f4390300c1d1c8", "ce0301000c0091023be516d1", '\x00\x00k\x00\x00\x00\x00\x00\x00 \x00']}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x14) userfaultfd(0x80001) r8 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::.:\x00', 0x0) 4.292833315s ago: executing program 4 (id=1290): sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x7, 0x3, 0x0, 0x2, 0x0, 0x1, 0x25dfdbfe}, 0x10}, 0x1, 0x7}, 0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000440)=""/162, 0xa2}, {&(0x7f0000000200)=""/108, 0x6c}, {&(0x7f0000000500)=""/156, 0x9c}], 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000080)={@remote, r3}, 0x14) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000300)={0x0, 0x0}) syz_open_procfs$userns(r5, &(0x7f0000000380)) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x0, 0x2, 0xffffffff, 0x3, 0x22}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) modify_ldt$write(0x1, &(0x7f0000000340)={0x8, 0x20000000}, 0x10) ioctl$HIDIOCSUSAGE(0xffffffffffffffff, 0x4018480c, &(0x7f00000005c0)={0x2, 0x2, 0xfff, 0x101, 0x32a10f43, 0x2c82}) socket(0x840000000002, 0x3, 0xff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680)) get_robust_list(0x0, &(0x7f0000000400)=0x0, &(0x7f0000000580)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x24, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 4.059000908s ago: executing program 1 (id=1291): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', r0}, 0x18) 3.699383733s ago: executing program 1 (id=1292): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 3.648257476s ago: executing program 2 (id=1293): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x7, 0x3, 0x0, 0x2, 0x0, 0x1, 0x25dfdbfe}, 0x10}, 0x1, 0x7}, 0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) bind$xdp(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) readv(r2, &(0x7f0000000040)=[{&(0x7f0000000440)=""/162, 0xa2}, {&(0x7f0000000200)=""/108, 0x6c}, {&(0x7f0000000500)=""/156, 0x9c}], 0x3) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000080)={@remote, r4}, 0x14) fcntl$getownex(r3, 0x10, &(0x7f0000000300)={0x0, 0x0}) syz_open_procfs$userns(r6, &(0x7f0000000380)) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x0, 0x2, 0xffffffff, 0x3, 0x22}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) modify_ldt$write(0x1, &(0x7f0000000340)={0x8, 0x20000000}, 0x10) ioctl$HIDIOCSUSAGE(0xffffffffffffffff, 0x4018480c, &(0x7f00000005c0)={0x2, 0x2, 0xfff, 0x101, 0x32a10f43, 0x2c82}) socket(0x840000000002, 0x3, 0xff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680)) get_robust_list(0x0, &(0x7f0000000400)=0x0, &(0x7f0000000580)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x24, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 3.593691815s ago: executing program 1 (id=1294): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8040480) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, r6}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r4) sendmsg$DEVLINK_CMD_SB_POOL_GET(r4, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r7, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0xd0, r7, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x9609}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x80c}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xc}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000240), &(0x7f00000002c0)='./file0\x00', 0x8, 0x1) fsopen(0x0, 0x0) socket(0x2b, 0xa, 0x3) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1001}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r10 = dup(r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x12, r10, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 3.113095965s ago: executing program 0 (id=1295): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x5c}}, 0x0) 2.808798094s ago: executing program 0 (id=1296): openat$mice(0xffffff9c, &(0x7f00000002c0), 0x212240) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(0x0, 0x1, 0x122c42) socket$kcm(0x10, 0x6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="d60400007d0000000524010000000000000000000000000000000000000000000c40000000000000000000000000000000002e00046e6f645a3dbf640237fc6225ffffff8005000000000000ff03ff92e91600059b65712c93cb3db6c231d119aaa139007002007dfa673effeb09b5351f5bde054000000000187b82d9b56928fbbf0b00002b595fcb14034354b9fd9ef196a51cd5157adc8106b494e13500cf60372d61cceab8c88641eb93b4ccf6002ab87bfc012796093f68305c4d2220837e0108e2e748501c51484ba02f109caaf91509a25500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cdb80e8d40700000037009d036f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0c41f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa75f8246bcc42eaa8c631c0c500959a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238593aed3b42ee7cac07de09d1d68a60333a882467d2b31aafb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fecdfd529f382066664c0fb4e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae122e6105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fc200000030e4ee2bfc7f8050851143e5161acd47150acbaf743822dfe203b108d37e914dc1e53e234c509eca4107a1712caa9da53d051c36884c79182661f3ca36bcdbfbbd267109f8319d8dd5c07099eb1b11030655f562694f61743d19421b4a19ef8b8b4ce9c993c7d6cb300c4e657a4e50a35b5cc16b8c161a8e3df9036bbcf28adcd19a6c4c291709aee5ab3e5bc5ae29f475e4d24408b5167d0faf5fc1566b705c8b60afa8aca42f7e0469188a0ef062ca18e38f9ee10ac77d2b7eb9d60ea79fdb556411e59dfbd8dbb8a2a6622ebcf84c696fa4da21bad2320d0d68e9bf4346f0686119a39e400395c8f2825ea069ae0e143bd1a44179ed8e3cea0b5e9a19cc7ffa500fa41b6c8049bde45827d54ec901d27ad125056889b3336b3f06838c5b667ae22efe3bc15b825f7fbce48027281cf9fe8fc21fc77c243de26705310eb81cf74de0293192a13f6ad057de61fd8aba8ef4439bc06a45b2b03162515a23433afeb52aedb5ab6f334653380515f779f35dc8a78c37772492a2284c21d21356d473f00f85137c7bf0636f757d3528869b3f007735cff85c9d978bf55dcc26d62d25e308f08827a91ff47bec92f8e91e7908665400aa4e39b35986239d5c7b9492c5bb26bc55b55b49ed70486e6e7da38c208450f9f79e1b4100000000000000000000000000ae51ceba44f717f0a07749239b5d08f8c5c0ad7951e0a7c7f3db8dfd3f8657258a6c04f32d57ad2873de45fa98b0f8267917ff9b3e9c0d74a5aca206fe29e0c1039f22553c2747425d831030782ee78f8ba35de318c53f094f925cc9782e94b6c870a487678bfae745dff268bda7fdec873ce4fb4b8dcba0419b30449adfef724162bfb10aafcfea48a67fae7733cc3a7f1eef91be5285215eab41f6", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0], 0x4d6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000a, 0x204031, r5, 0xffffd000) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) 1.912018104s ago: executing program 4 (id=1297): r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r1, 0x58, &(0x7f0000000040)}, 0x10) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = userfaultfd(0x80001) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000180)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)}], 0x1}], 0x1, 0x40800) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) r3 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000800)=[{0x0, 0x0, &(0x7f0000001e80)=[{&(0x7f0000000700)="ce2ede98d4bde4b9a7931c4e260090a647151bacb721146be7ff4494578b050dc8c56c1571aa57d0f79d3ce5cc42977a719f4a8c88be34", 0x37}, {&(0x7f0000000600)="5fec9dec1e9d48e2b3a02e29dcaadb6d242c08b8b6e2a34dd08e48e3d32aa2bf0bd42348d6bf39fd7dac80fedaaab8ff4258ecbc4e025305fab94303f773d083bb47da24c3341e27416f38e3251fe082c8f8602308cd2f7dc846c93e62a8d53d22fcabce47b5531463290c970dccfaa7da3e4ee56136f44b991100e3db7c750c3ccb3e01d6598d53d05ca7503d7430f3ff2b79ab629faa1dfb2d0899dd807d28174305bd600e50112aa4d0ec230a89b3078bb60a198e5a7169d91005cda3fc9870956d72773bd700", 0xc8}, {&(0x7f0000002dc0)="c615271a9dc3c1d27eee864db95e0b71f8e4965515323d75357cb0914b03d9b18c63ca3692399e0aa8be01a5b9883f1e4830cd8b777bb75c27cba21f087b8a8a92bb4353b5e825f3837bfcce5681589bd0ce90380fed43b1ebc4d4c4e3efe4c1a60e3d56753ebac731ddf0a80a42e71cd2fa58a5779bd29d2b", 0x79}, {&(0x7f0000000cc0)="bd6da0bd46a67e8c2a3d543a4fa450b226da5f9481ab800025ea23e9d7a56f521541e97d4f1d383676059f660d7f6a42753aeb13a396059e44891d630189c8bd6ea5c7afd6f58cb9f90be3d0c355d7002cad13dab28d84a19127cfea54a0ee6ff2f7de284e54b464e1799f9b67176e5e7af67eab6bade0c22808aa7121e3c7bec7415fb675ea9ea6c1d05f37802408f0690cd93fabe33479183113ffe63babd039dc34c0a0a87ecde8a2d020056439bebcc8c647c9073620a6216f840424a6e68337655b339fc5afe5e29da95e661fa97070a24a5e19aa9de6493308aadceb947f05c3fddc809fb53e69a5c65c2354dc3bbe4c0a0a94ff78f9cf35fbbf19da62ee4f15e836a3483174a40e028cca49b061b7147bfb95ebfc2c8a15b3aa1bc31a97881054e01bbc80e3016798f61471ad53ec9a76d01f79df87b379cf590daae4eed8d996319fc30e38220a9a8c19cccd7bceb317c1019a5ca51c156c83cbe08e0b463cee4b1c6695a75fcbcc82c5365be16a33b58870397a7908933d5e28eaed4d0144380a761ed8a69bcaecc19dc1934a2416a0974c6717475726746abe9a3e6d1a9d24438594c0dce267a6388446538e3a81ed48e0c7c7fdb62d489cbcc0608a5ee8cfc35392c8dbea74256d2a182a618005bcdd8b3b957d751aac96a2170a6e4534863943da50ac23a0a84765a41d726faecd40c49c71af960f1c622ec17f5aa0d4b311015e760c10b02d99ece62f24fdb2266502b5002c5ff79fffed64fa19af9881a59aa08a7835f29ab2824cc68a9069d7b09262b25527a14212ae304f7896fdce51414b1998ba2cc96c595324bbb411d1101b5e1408d785c84d2eae893b1b8bfabe408dc49afa566410d37d06686bdbbd99cb1c8c7fcb48a372f2174b9ccbe782d2c0a6b080196fa0bcc96b5f273914e7ce0f146362c4ffcc75895b2f3912d3ed96230560222a27eaca42bfc7ec80f450b2c82726e8abccbc4626f4384a6c62cf41fc45a8409d52955f0a1b3b56090a537ca315bbd1865b960935e8e06cc1367aa77c32fd66ddad9bd19e9281164784e0696dbcf281c02286e3f235ddfaa62f4e76bf91851480b714809bed7d4721e89dba482205977c95b5523fd369678a59e6c62ab19ae2c90855051e97d46bbbf9f69a503886d3ab3d9c779e17cbcb4d8d46574f48a01cfaeefd65668b6c0dc5a0076251b944e9ceb5ebe246bb4173d09d4774584dd3b816d9129396df10415097878fa93db94eafad0080d4ee158f79bfbcd9564b008de7643fb7e3a06b383741b8a24ca02e64fae9c8ad67ae593701cf4687911e4d856c5f8be54257d6feec2a95ef3080ab7c3897abb5aad0ca0d286e3f6c185dcf85b3784f817d82d5a37e22eb407b77bfb1d3dab0bd49f7693c9a4115c99a7cbc569b731c34cac832048262cdc70e9379558d52175a6bddff9bb46cc866fd2e98d5e9665b0a2a46c4187c94782f3d868e3c42c853d141fc77dc30f0abf04c10fdf00ca203df6b6935ea6c47377201c02f10fd759ef71d290519a041333a75a0e4aa745484021bbc893b791bce0af4c1f7372c16502c26e5e60de278b209c0c7c65599fc4ed8c976e03e26f7024a2a597932afb6d8fff791f8bfd9d13d213034b5", 0x488}], 0x4, 0x0, 0x0, 0x44410}], 0x1, 0x48800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r4, r5, 0x0, 0x2000fb) ioctl$BLKFRASET(r5, 0x1264, &(0x7f00000002c0)=0x9) 1.883628655s ago: executing program 2 (id=1298): socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000140)={@local, @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @random="d8fc988d892e", @remote, @broadcast, @private=0xa010100}}}}, &(0x7f0000000180)={0x1, 0x3, [0xba0, 0x74f, 0x7b2, 0x90c]}) openat$sysfs(0xffffffffffffff9c, 0x0, 0x800, 0x81) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x40, 0x2, 0x1, 0x801, 0x0, 0x0, {0x7, 0x0, 0x7}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xb}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x2}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xe, 0x1, 'snmp_trap\x00'}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x8000) r1 = syz_open_dev$video4linux(&(0x7f0000000180), 0xffffffff, 0x40000) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f00000001c0)={0x0, 0x0, {0x3, 0x3, 0x1003, 0x6, 0xd, 0x7, 0x1}}) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0xe0, &(0x7f00000004c0)={0x4, 0x14, 0x14, 0x3}, 0x8, 0x1, 0x7, 0x0, 0x0, 0x6, 0x0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) ioctl$USBDEVFS_CONNECTINFO(r2, 0x40085511, &(0x7f0000000080)) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) socket(0x10, 0x3, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x3000) r3 = userfaultfd(0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x280}) socket(0x22, 0x2, 0x3) r4 = socket$isdn(0x22, 0x2, 0x3) close(r4) r5 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r7, {0xffff, 0xa}, {0xffff, 0xffff}, {0x1a, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x4f33c51}, 0xa5, 0x5, 0xffffffd}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x55}, 0x84) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x3, 0x7, @loopback, 0x800000}, 0x1c) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000000)={&(0x7f000090c000/0x2000)=nil, 0x2000}) 1.589459274s ago: executing program 4 (id=1299): openat$mice(0xffffff9c, &(0x7f00000002c0), 0x212240) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(0x0, 0x1, 0x122c42) socket$kcm(0x10, 0x6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) write$P9_RSTATu(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="d60400007d0000000524010000000000000000000000000000000000000000000c40000000000000000000000000000000002e00046e6f645a3dbf640237fc6225ffffff8005000000000000ff03ff92e91600059b65712c93cb3db6c231d119aaa139007002007dfa673effeb09b5351f5bde054000000000187b82d9b56928fbbf0b00002b595fcb14034354b9fd9ef196a51cd5157adc8106b494e13500cf60372d61cceab8c88641eb93b4ccf6002ab87bfc012796093f68305c4d2220837e0108e2e748501c51484ba02f109caaf91509a25500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cdb80e8d40700000037009d036f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0c41f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa75f8246bcc42eaa8c631c0c500959a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238593aed3b42ee7cac07de09d1d68a60333a882467d2b31aafb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fecdfd529f382066664c0fb4e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae122e6105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fc200000030e4ee2bfc7f8050851143e5161acd47150acbaf743822dfe203b108d37e914dc1e53e234c509eca4107a1712caa9da53d051c36884c79182661f3ca36bcdbfbbd267109f8319d8dd5c07099eb1b11030655f562694f61743d19421b4a19ef8b8b4ce9c993c7d6cb300c4e657a4e50a35b5cc16b8c161a8e3df9036bbcf28adcd19a6c4c291709aee5ab3e5bc5ae29f475e4d24408b5167d0faf5fc1566b705c8b60afa8aca42f7e0469188a0ef062ca18e38f9ee10ac77d2b7eb9d60ea79fdb556411e59dfbd8dbb8a2a6622ebcf84c696fa4da21bad2320d0d68e9bf4346f0686119a39e400395c8f2825ea069ae0e143bd1a44179ed8e3cea0b5e9a19cc7ffa500fa41b6c8049bde45827d54ec901d27ad125056889b3336b3f06838c5b667ae22efe3bc15b825f7fbce48027281cf9fe8fc21fc77c243de26705310eb81cf74de0293192a13f6ad057de61fd8aba8ef4439bc06a45b2b03162515a23433afeb52aedb5ab6f334653380515f779f35dc8a78c37772492a2284c21d21356d473f00f85137c7bf0636f757d3528869b3f007735cff85c9d978bf55dcc26d62d25e308f08827a91ff47bec92f8e91e7908665400aa4e39b35986239d5c7b9492c5bb26bc55b55b49ed70486e6e7da38c208450f9f79e1b4100000000000000000000000000ae51ceba44f717f0a07749239b5d08f8c5c0ad7951e0a7c7f3db8dfd3f8657258a6c04f32d57ad2873de45fa98b0f8267917ff9b3e9c0d74a5aca206fe29e0c1039f22553c2747425d831030782ee78f8ba35de318c53f094f925cc9782e94b6c870a487678bfae745dff268bda7fdec873ce4fb4b8dcba0419b30449adfef724162bfb10aafcfea48a67fae7733cc3a7f1eef91be5285215eab41f6", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0], 0x4d6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000a, 0x204031, r4, 0xffffd000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) 1.462925689s ago: executing program 1 (id=1300): socket$rxrpc(0x21, 0x2, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x305200, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x80001, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0x7, 0xb}, {0xfff2, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c9e0}, 0x4008080) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000440)) getrlimit(0x1d, 0x0) r6 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r8, 0x720, &(0x7f0000000100)={0x1, 0x6d, 0x2, &(0x7f0000000240)={0xa1, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9951cf5a1dee93"}}) 1.040355095s ago: executing program 0 (id=1301): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000800)='\xff\x00l\x1e\xa00x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002800500030004000000140007000000000000000000000000000000000108000a00", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000000)=0x1000) r6 = syz_io_uring_setup(0x235, &(0x7f0000001240)={0x0, 0x10008cc8, 0x10100, 0x2, 0x75}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x3b, 0x2, 0x1}) io_uring_enter(r6, 0x7a98, 0x0, 0x0, 0x0, 0xfffffffffffffc76) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r5, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000000)=0x4000) r9 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) ioctl$DVB_DEMUX_DMX_SET_FILTER(r9, 0x403c6f2b, &(0x7f0000000040)={0x5, {"4e068be8035430cf8aa115d0d8d0f21c", "af86a7d62fdce0b68c2a7502b5b00c9f", "faef725a066e767106fa1a96391039d1"}, 0xe, 0x5}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r9, 0x40146f2c, &(0x7f0000000180)={0x7, 0x0, 0x3, 0x41, 0x4}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="8000a6040a000200aaaaaaaaaa1c"], 0x28}, 0x1, 0x1000000, 0x0, 0x11}, 0x0) syz_usb_control_io$printer(r0, &(0x7f00000003c0)={0x14, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0003020000010203"]}, 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffc) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000800)={0x14, &(0x7f0000000700)={0x40, 0x30, 0x34, {0x34, 0x6, "43f76ad43e9baa17d02347331f8ae33618b835709a824a2a1b2a1a76315b78fe79558940e6b62a8bb0651810b8dabb1a18fa"}}, &(0x7f00000007c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000009c0)={0x1c, &(0x7f0000000840)={0x0, 0x9, 0xd7, "a57950a3bfd5df0dccabc1c1b9083646c5b55a1e12024a410154fa8fc7fb9db0ca195b49d7c450a1ec84c78c9405d5453431d7603ba0e2435192d84ebbc8984e3ae1b7c445a6e282bbbccc79119d412b8a1311e5dbca1c671aa095effb46aa48e416543c8356c97befba8651fb57d2daf665582eeede1a2dfe2ef9fdb5ea37fe19f03a29b0ec20984874dc4aae01757f88e44cfdf0dd135d88fc74d286bc5a686aa0338432fbc60b65bcbf6be51833f650f5308d5407cc799a31316b2b5d08fbe47a60a28dac99d93708d23924c139bb54e2c9808143f5"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x4}}) syz_usb_control_io$uac3(r0, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x9e1657741cc906b7, 0x4, 0x5c, {0x5c, 0x24, "67a6f3bd1f9c1e6a6c28235063febcd26562025530be307015103a3a73d34f6366ad75ea36d4f10cf7e5108793db029fbe45a7fe035be8ed69dc15a1759418c82868a77690b57e07d307899fcc87a9e92f7205d73e596c3cc04c"}}, &(0x7f00000000c0)={0x0, 0x3, 0x46, @string={0x46, 0x3, "7b58f8d42dc46f04da2df68bb8eff1aa2836dd794828696611423e01fa480bc9bc5eb25a2a4c76bd0e013a7e1d939e5ccd9464ec662df9b99d260a2f12592f244e4cd95b"}}}, &(0x7f00000004c0)={0x44, &(0x7f0000000180)={0x0, 0xa, 0x9c, "220b582b1fd0c6979a347baeccc58e39cd4f07d5faabc65d15188b05649a786252cef216eb97608a6235c55aef5d02d7ebbff110dd1c57db1f02bdaceea4158a69f9e9dfa5fc5c151a777f254bd99b524e343e2e344b461be4e6cd277a47c522def9c3cbbc046245d712a14dcde9e12a6bdbf683e0c998c31dc91872cb55be97272df78ef6048d8982e53c96bf0288bca5a9e6f84185d6796a457aa8"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000300)={0x0, 0x8, 0x1}, &(0x7f0000000340)={0x20, 0x81, 0x2, "431e"}, &(0x7f0000000380)={0x20, 0x82, 0x1, "9d"}, &(0x7f0000000400)={0x20, 0x83, 0x3, 'A;Q'}, &(0x7f0000000440)={0x20, 0x84, 0x4, "40bdb098"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "a3a3d3"}}) write$char_usb(r10, &(0x7f0000000000)="93", 0xf5) r11 = syz_open_procfs(0x0, &(0x7f00000005c0)='net/udplite6\x00') preadv(r11, &(0x7f0000000580)=[{&(0x7f00000001c0)=""/109, 0x6d}, {&(0x7f0000000340)=""/173, 0xad}, {&(0x7f0000000600)=""/150, 0x96}], 0x3, 0xa3, 0x7) syz_usb_connect(0x4, 0x1bf, &(0x7f0000000a00)={{0x12, 0x1, 0x110, 0xfb, 0x16, 0xf8, 0x40, 0x3275, 0x80, 0x790c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1ad, 0x2, 0x2, 0x9, 0xb0, 0x1, "", [{{0x9, 0x4, 0xa7, 0x8, 0x3, 0x6e, 0xf8, 0xc, 0xc, [@uac_control={{0xa, 0x24, 0x1, 0x6, 0x3f}, [@processing_unit={0xb, 0x24, 0x7, 0x1, 0x5, 0x7, "03079ad7"}, @output_terminal={0x9, 0x24, 0x3, 0x5, 0x303, 0x2, 0x3, 0xa}, @input_terminal={0xc, 0x24, 0x2, 0x2, 0x204, 0x5, 0x6, 0x2, 0x7, 0xf}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x202, 0x1, 0xf3, 0xa, 0xa, 0x81}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x401, 0x6, 0x4, 0x8}]}, @generic={0x4a, 0x24, "59c527e4025c80782dece2c4b5ca76bfc1f2c32da6206ac0585328bee6f3420c2173a4fd912de7637f54d357a2cc3325e7dc0598d0cd13dc12e043ed74b6c63ac3fbc01c5bfdc936"}], [{{0x9, 0x5, 0x8, 0x10, 0x3ff, 0x5, 0xfe, 0xf8}}, {{0x9, 0x5, 0x3, 0x10, 0x400, 0x0, 0x5, 0x5, [@generic={0x5, 0x23, 'XK\a'}]}}, {{0x9, 0x5, 0x6, 0x0, 0x400, 0x6, 0x6, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x18, 0xe}, @generic={0x84, 0x31, "934e8f3458f71d087d06b61e07a3688803de0cd9725a650f1e7bc9dfa3d92364605138421d8f56b4302c69893eaf85e78fbf4c04ffc2c88c2dd17a652bcf4c42e92f4f58209eed3eaa06a22758712cb8af80898c4a5adfc967e535ec58c7dde8c0c7b4f1801835729a04f28abf531cefef2787811632aa2a061f6c528df719db8887"}]}}]}}, {{0x9, 0x4, 0xfe, 0xa2, 0x1, 0x9c, 0xfd, 0x29, 0xa3, [], [{{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x0, 0x7, 0xfb, [@generic={0x4e, 0x22, "a22ad18f4c12c25bad9ae6ce01dcbcd1ae7850ab0c7a7820f708ea9c991a5627bf85d3566ad98d7d62ed8a2aeea81dece95f96fd210cd00254f6f001f3375d733e9180e5576d052d457d531a"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x7}]}}]}}]}}]}}, &(0x7f0000000d40)={0xa, &(0x7f0000000bc0)={0xa, 0x6, 0x200, 0x8, 0x2, 0x6, 0x10, 0x2}, 0xfc, &(0x7f0000000c00)={0x5, 0xf, 0xfc, 0x5, [@wireless={0xb, 0x10, 0x1, 0xc, 0x12, 0x7, 0x5, 0x8000, 0x40}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "14b9ea4d38bbabb555691a1a63ad2945"}, @generic={0xd2, 0x10, 0x2, "995e82c733318fff8d9e5b61c04794abb5c188d2596b6e32092c8e683319fab175858a5730d089387019451ec59069675026d066844c02fdcf5381f5693df06b03416ac1bbd2baf7fe29311945e7438a9f7f9eceef99e38fbb3d1fc240b2e3f3c807f897e38d8e43f581bc46fefb1d448f6b268cfd1a6af1c1d3f716d60fc38cc8920e042aba2bdf01bdc5c3a96fbadf5c33cba8692508d4f38c8e7b032c07bffc74abe26232641a855556ce08b58d708af2b6c8ad95ad13bfef2e47186ad712a9e3b07256c0aec745d543d958cf6d"}]}, 0x1, [{0x4, &(0x7f0000000d00)=@lang_id={0x4, 0x3, 0x833}}]}) socket$can_bcm(0x1d, 0x2, 0x2) 423.350823ms ago: executing program 3 (id=1303): openat$mice(0xffffff9c, &(0x7f00000002c0), 0x212240) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(0x0, 0x1, 0x122c42) socket$kcm(0x10, 0x6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="d60400007d0000000524010000000000000000000000000000000000000000000c40000000000000000000000000000000002e00046e6f645a3dbf640237fc6225ffffff8005000000000000ff03ff92e91600059b65712c93cb3db6c231d119aaa139007002007dfa673effeb09b5351f5bde054000000000187b82d9b56928fbbf0b00002b595fcb14034354b9fd9ef196a51cd5157adc8106b494e13500cf60372d61cceab8c88641eb93b4ccf6002ab87bfc012796093f68305c4d2220837e0108e2e748501c51484ba02f109caaf91509a25500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cdb80e8d40700000037009d036f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0c41f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa75f8246bcc42eaa8c631c0c500959a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238593aed3b42ee7cac07de09d1d68a60333a882467d2b31aafb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fecdfd529f382066664c0fb4e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae122e6105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fc200000030e4ee2bfc7f8050851143e5161acd47150acbaf743822dfe203b108d37e914dc1e53e234c509eca4107a1712caa9da53d051c36884c79182661f3ca36bcdbfbbd267109f8319d8dd5c07099eb1b11030655f562694f61743d19421b4a19ef8b8b4ce9c993c7d6cb300c4e657a4e50a35b5cc16b8c161a8e3df9036bbcf28adcd19a6c4c291709aee5ab3e5bc5ae29f475e4d24408b5167d0faf5fc1566b705c8b60afa8aca42f7e0469188a0ef062ca18e38f9ee10ac77d2b7eb9d60ea79fdb556411e59dfbd8dbb8a2a6622ebcf84c696fa4da21bad2320d0d68e9bf4346f0686119a39e400395c8f2825ea069ae0e143bd1a44179ed8e3cea0b5e9a19cc7ffa500fa41b6c8049bde45827d54ec901d27ad125056889b3336b3f06838c5b667ae22efe3bc15b825f7fbce48027281cf9fe8fc21fc77c243de26705310eb81cf74de0293192a13f6ad057de61fd8aba8ef4439bc06a45b2b03162515a23433afeb52aedb5ab6f334653380515f779f35dc8a78c37772492a2284c21d21356d473f00f85137c7bf0636f757d3528869b3f007735cff85c9d978bf55dcc26d62d25e308f08827a91ff47bec92f8e91e7908665400aa4e39b35986239d5c7b9492c5bb26bc55b55b49ed70486e6e7da38c208450f9f79e1b4100000000000000000000000000ae51ceba44f717f0a07749239b5d08f8c5c0ad7951e0a7c7f3db8dfd3f8657258a6c04f32d57ad2873de45fa98b0f8267917ff9b3e9c0d74a5aca206fe29e0c1039f22553c2747425d831030782ee78f8ba35de318c53f094f925cc9782e94b6c870a487678bfae745dff268bda7fdec873ce4fb4b8dcba0419b30449adfef724162bfb10aafcfea48a67fae7733cc3a7f1eef91be5285215eab41f6", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0], 0x4d6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000a, 0x204031, r5, 0xffffd000) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) 76.704055ms ago: executing program 4 (id=1304): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 0s ago: executing program 4 (id=1305): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) r5 = dup(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000c54a4530bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffffcf6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a1a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2dff0f000000000000bf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f2cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880b9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) socket$can_bcm(0x1d, 0x2, 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="b70000000000000007000000000000009500000000000000a9171809f8dcf159569d5475991f7de1a0d0c119cfcf6b98741c23fb7f8d3002ec85db75af955427e91496087a51a0a78f269a9e216a0d0177c4fe3552396a180330807a5b6e8c79aa92038c78d1f16c1323f0e0c8d45c641a21757847cb22230e4321cc3581e40c62c4defee8cffe359cfeef7f58fffdb48647d28ae810f6d22d20271e9e88e94aa6982bf48356652b08e2fbd404e41e0058aae0478fbe542b648421d1b4486a542a7d478fbe6b5e000000293853f9c68e235184b7ad5b6c4fe70ec8320500db0db7fda3da6171a05509ffecef2cb9802d4f36c9a1ce46d3b355fec188ccfc2f0fc89e164561fb06ee9a0153981a47b5de9edd3536d5534f9a699f73b2c9341d2d05043748ce1f4577ed76cdf5b3c697089daa4abda69a8c0c992404610a6be9e103c972459065dec0488e85a6a0418fc87dd8019ef7bb4ef4fa6ee08d81797570578f2e8198e687012f25a69a90e7515e35f8abbddfa96c3f0485f01f0e9e144a2bd31c1b594c50de7c9efd826f1e19b7bd89ca4052b1985287bd13957a48467e0eeddf564d175bf4340885b63976df609806c3b2a3667539dfd66a7400000000003be6026e60205f761ce85cdf75cdb95ca5d32b5bf87eed4184d49f8f48181ef2419efe82ebb18ee55772d562b3b49551714e805a5211a3f4e8e703c03e23b2074bc573dbb66d59e269b722637c4a2efb5241cae2f14774609ad91d66724c438455dc4fcf0b4c8fc235f6c190b4c82bb2556d1fbcd4468369e98e900c743162ce2c7e60610acf0c8e4ba94a7e7127c7de0e6c35acecee1b8434fdca4579f9ebc6a515f7d910b466eb583fb0a7e65fbecb2b8ee0e9da33afb88aa5da8da3a5e0e58fcb48de6f165826b046a8951a47e040bd419d0efa0f54e8e3694085a7bde6f6494968d8200000000000"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff37}, 0x48) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0x1000000000000f, &(0x7f0000000080)=0x7fffffff, 0x4) setsockopt$sock_attach_bpf(r7, 0x1, 0x34, &(0x7f0000000040)=r6, 0x4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, 0x0, &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r9 = dup2(r8, r6) setsockopt$sock_attach_bpf(r7, 0x1, 0x34, &(0x7f00000000c0)=r9, 0x4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x44, r2, 0x8, 0x0, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x38}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x44}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000226bd70a3fcffff252180000008001c000800000031c4f093734ba9e2cc45c798ac"], 0x1c}, 0x1, 0x0, 0x0, 0x14005}, 0x4000000) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_SET_IRQCHIP(r11, 0x8208ae63, 0x0) ioctl$VIDIOC_ENUMSTD(0xffffffffffffffff, 0xc0485619, &(0x7f00000001c0)={0x4, 0xff06ff, "c7b12c99c5b7b76f07b0421397e9f64942b335139666936b", {0xc, 0x3}, 0xc48}) kernel console output (not intermixed with test programs): 6.441052][ T24] hid-generic 00A0:0006:0003.000C: hidraw0: HID v0.05 Device [syz0] on syz0 [ 396.489158][ T5940] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 396.511764][ T1168] usb 2-1: config 0 has no interfaces? [ 396.558479][ T1168] usb 2-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 396.574958][ T1168] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.724501][ T1168] usb 2-1: config 0 descriptor?? [ 396.736589][ T9905] netlink: zone id is out of range [ 396.800201][ T5940] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 396.809636][ T5940] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 396.828071][ T9905] netlink: zone id is out of range [ 396.836489][ T5940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 396.855936][ T5940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 396.943148][ T9905] netlink: zone id is out of range [ 396.949174][ T9905] netlink: zone id is out of range [ 396.954335][ T9905] netlink: zone id is out of range [ 396.979089][ T9905] netlink: zone id is out of range [ 396.984265][ T9905] netlink: zone id is out of range [ 396.989499][ T5940] usb 4-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 396.999379][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.008236][ T5940] usb 4-1: Product: syz [ 397.086793][ T5834] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 397.086842][ T5940] usb 4-1: Manufacturer: syz [ 397.099271][ T5940] usb 4-1: SerialNumber: syz [ 397.117210][ T5940] usb 4-1: config 0 descriptor?? [ 397.126755][ T9912] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 397.473289][ T9912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 397.488750][ T9912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 397.497578][ T9905] netlink: zone id is out of range [ 397.517778][ T5940] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 397.538731][ T5940] input: Griffin SoundKnob as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input22 [ 397.577867][ T9905] netlink: zone id is out of range [ 398.090838][ C0] powermate: config urb returned -71 [ 398.096827][ C0] powermate: config urb returned -71 [ 398.102424][ C0] powermate: config urb returned -71 [ 398.108961][ C0] powermate: config urb returned -71 [ 398.187919][ T5940] usb 4-1: USB disconnect, device number 30 [ 398.187985][ C0] powermate 4-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 398.817740][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 398.817761][ T30] audit: type=1326 audit(1772318652.918:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9922 comm="syz.3.812" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fea5a19c799 code=0x0 [ 399.285673][ T5940] usb 2-1: USB disconnect, device number 24 [ 400.103459][ T30] audit: type=1804 audit(1772318654.208:295): pid=9925 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.812" name="/newroot/155/file1" dev="tmpfs" ino=832 res=1 errno=0 [ 401.304694][ T9952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.819'. [ 401.947340][ T5882] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 402.158600][ T9961] IPVS: You probably need to specify IP address on multicast interface. [ 402.208293][ T5882] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 402.218047][ T5882] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 402.265407][ T9961] IPVS: Error connecting to the multicast addr [ 402.288406][ T5882] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 402.340886][ T5882] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 402.350462][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 402.359055][ T5882] usb 5-1: Product: syz [ 402.363321][ T5882] usb 5-1: Manufacturer: syz [ 402.374072][ T5882] usb 5-1: SerialNumber: syz [ 402.732917][ T9965] netlink: 8 bytes leftover after parsing attributes in process `syz.0.822'. [ 402.839045][ T9955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.888538][ T9955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.059727][ T5882] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 31 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 403.309781][ T9971] Cannot find del_set index 2 as target [ 404.255062][ T9981] fuse: Bad value for 'rootmode' [ 404.662505][ T24] usb 5-1: USB disconnect, device number 31 [ 404.680572][ T24] usblp0: removed [ 404.814405][ T9986] netlink: 8 bytes leftover after parsing attributes in process `syz.4.826'. [ 406.008486][ T5896] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 406.029071][T10002] netlink: 8 bytes leftover after parsing attributes in process `syz.1.833'. [ 406.046653][ T5834] Bluetooth: hci2: SCO packet for unknown connection handle 200 [ 406.178696][ T5896] usb 1-1: Using ep0 maxpacket: 16 [ 406.227290][T10009] netlink: 4 bytes leftover after parsing attributes in process `syz.4.832'. [ 406.257851][ T5896] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 406.288841][ T5896] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 406.299127][ T24] usb 3-1: new low-speed USB device number 20 using dummy_hcd [ 406.354585][ T5896] usb 1-1: config 0 interface 0 has no altsetting 0 [ 406.437683][T10015] fuse: Bad value for 'rootmode' [ 406.531271][ T5896] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 406.541376][ T5896] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.608426][ T24] usb 3-1: Invalid ep0 maxpacket: 16 [ 406.639987][ T5896] usb 1-1: config 0 descriptor?? [ 406.668636][ T5882] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 406.743665][ T24] usb 3-1: new low-speed USB device number 21 using dummy_hcd [ 406.822256][ T5882] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 406.835481][ T5882] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 406.897130][ T5882] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 406.898325][ T24] usb 3-1: Invalid ep0 maxpacket: 16 [ 406.926041][ T24] usb usb3-port1: attempt power cycle [ 406.973771][ T5882] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 406.998381][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 407.044327][ T5882] usb 2-1: Product: syz [ 407.067611][ T5896] hid_parser_main: 1 callbacks suppressed [ 407.067631][ T5896] nzxt-smart2 0003:1E71:2009.000D: unknown main item tag 0x0 [ 407.083922][ T5896] nzxt-smart2 0003:1E71:2009.000D: unknown main item tag 0x0 [ 407.092842][ T5882] usb 2-1: Manufacturer: syz [ 407.117921][ T5882] usb 2-1: SerialNumber: syz [ 407.122237][ T5896] nzxt-smart2 0003:1E71:2009.000D: unknown main item tag 0x0 [ 407.233267][ T5896] nzxt-smart2 0003:1E71:2009.000D: unknown main item tag 0x0 [ 407.270569][T10019] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 407.278060][ T5896] nzxt-smart2 0003:1E71:2009.000D: unknown main item tag 0x0 [ 407.311265][ T24] usb 3-1: new low-speed USB device number 22 using dummy_hcd [ 407.344737][ T24] usb 3-1: Invalid ep0 maxpacket: 16 [ 407.352824][ T5896] nzxt-smart2 0003:1E71:2009.000D: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 407.453614][T10014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.503358][T10014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.504146][ T24] usb 3-1: new low-speed USB device number 23 using dummy_hcd [ 407.534259][ T5882] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 407.556681][ T24] usb 3-1: Invalid ep0 maxpacket: 16 [ 407.565081][ T24] usb usb3-port1: unable to enumerate USB device [ 407.662585][T10023] netlink: 'syz.4.838': attribute type 1 has an invalid length. [ 407.679239][T10023] netlink: 'syz.4.838': attribute type 2 has an invalid length. [ 407.747191][T10023] netlink: 8 bytes leftover after parsing attributes in process `syz.4.838'. [ 407.809501][T10023] netlink: 'syz.4.838': attribute type 2 has an invalid length. [ 407.817290][T10023] netlink: 'syz.4.838': attribute type 2 has an invalid length. [ 407.835646][T10023] netlink: 'syz.4.838': attribute type 2 has an invalid length. [ 407.847681][T10023] netlink: 'syz.4.838': attribute type 2 has an invalid length. [ 407.855652][T10023] netlink: 288 bytes leftover after parsing attributes in process `syz.4.838'. [ 408.048287][ T5940] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 408.093616][ T5882] usb 1-1: USB disconnect, device number 30 [ 408.208454][ T5940] usb 5-1: Using ep0 maxpacket: 8 [ 408.215062][ T5940] usb 5-1: config 6 has an invalid interface number: 14 but max is 0 [ 408.223490][ T5940] usb 5-1: config 6 has no interface number 0 [ 408.229708][ T5940] usb 5-1: config 6 interface 14 has no altsetting 0 [ 408.245532][ T5940] usb 5-1: New USB device found, idVendor=2c7c, idProduct=0191, bcdDevice=54.8d [ 408.255907][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.268858][ T5940] usb 5-1: Product: syz [ 408.274865][ T5940] usb 5-1: Manufacturer: syz [ 408.281302][ T5940] usb 5-1: SerialNumber: syz [ 408.509480][ T5940] usb 5-1: USB disconnect, device number 32 [ 408.739894][T10038] netlink: 8 bytes leftover after parsing attributes in process `syz.0.842'. [ 409.332396][T10047] kvm: vcpu 2: requested 128 ns lapic timer period limited to 200000 ns [ 409.471919][T10047] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 409.531262][ T5921] usb 2-1: USB disconnect, device number 25 [ 409.531494][T10052] netlink: 8 bytes leftover after parsing attributes in process `syz.3.846'. [ 409.574927][ T5921] usblp0: removed [ 410.411695][ T5921] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 410.477310][T10071] Cannot find del_set index 2 as target [ 410.811194][ T5921] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 410.837977][ T5921] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 410.882065][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.976120][ T5921] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 411.589034][T10093] netlink: 4 bytes leftover after parsing attributes in process `syz.4.851'. [ 412.089503][ T5921] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 412.645783][ T5921] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -110 [ 412.657975][ T5921] stv0680 1-1:4.0: last error: 0, command = 0x0 [ 412.692754][ T5921] usb 1-1: USB disconnect, device number 31 [ 412.711587][ T30] audit: type=1326 audit(1772318666.798:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10110 comm="syz.1.855" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9a5259c799 code=0x0 [ 413.679172][T10135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.858'. [ 413.738301][ T5940] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 413.891275][ T5940] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 413.912483][ T5940] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 413.963927][ T5940] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 414.043881][ T5940] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 414.122469][ T5940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 414.147149][ T5940] usb 1-1: Product: syz [ 414.159609][ T5940] usb 1-1: Manufacturer: syz [ 414.176170][ T5940] usb 1-1: SerialNumber: syz [ 414.250522][ T30] audit: type=1804 audit(1772318668.358:297): pid=10114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.855" name="/newroot/181/file1" dev="tmpfs" ino=965 res=1 errno=0 [ 414.970001][T10129] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.048868][T10129] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.236482][ T5940] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 32 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 415.817249][T10166] xt_TPROXY: Can be used only with -p tcp or -p udp [ 415.851516][T10166] tipc: Enabled bearer , priority 0 [ 415.859374][T10166] syzkaller0: entered promiscuous mode [ 415.864984][T10166] syzkaller0: entered allmulticast mode [ 415.883955][T10166] tipc: Resetting bearer [ 415.899955][T10165] tipc: Resetting bearer [ 415.926106][T10165] tipc: Disabling bearer [ 416.962012][ T5921] usb 1-1: USB disconnect, device number 32 [ 416.983857][ T5921] usblp0: removed [ 417.378402][ T5882] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 417.550086][ T5882] usb 5-1: device descriptor read/64, error -71 [ 417.964821][ T5882] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 418.188247][ T5882] usb 5-1: device descriptor read/64, error -71 [ 418.278280][ T5940] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 418.298681][ T5882] usb usb5-port1: attempt power cycle [ 418.439910][ T5940] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 418.468257][ T5940] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 418.520864][ T5940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.590630][ T5940] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 418.639127][ T5882] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 418.722898][ T5882] usb 5-1: device descriptor read/8, error -71 [ 418.799430][T10193] netlink: 'syz.0.869': attribute type 29 has an invalid length. [ 418.822422][T10193] netlink: 'syz.0.869': attribute type 29 has an invalid length. [ 418.862535][T10193] netlink: 500 bytes leftover after parsing attributes in process `syz.0.869'. [ 419.181830][ T5882] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 419.242642][ T5882] usb 5-1: device descriptor read/8, error -71 [ 419.759549][ T5940] stv0680 3-1:4.0: STV(e): camera ping failed!! [ 419.848608][ T5882] usb usb5-port1: unable to enumerate USB device [ 420.151134][ T5940] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 420.181458][ T5940] stv0680 3-1:4.0: last error: 0, command = 0x0 [ 420.274011][ T5921] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 420.298611][ T5940] usb 3-1: USB disconnect, device number 24 [ 420.509262][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 420.540615][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 420.640857][ T5921] usb 1-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 420.670591][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.699934][ T5921] usb 1-1: config 0 descriptor?? [ 421.273066][ T5921] hkems 0003:2006:0118.000E: ignoring exceeding usage max [ 421.332783][T10224] fuse: Unknown parameter 'use00000000000000000000' [ 421.357300][ T5921] hkems 0003:2006:0118.000E: hidraw0: USB HID v0.00 Device [HID 2006:0118] on usb-dummy_hcd.0-1/input0 [ 421.372262][ T5921] hkems 0003:2006:0118.000E: no inputs found [ 421.385548][ T5921] hkems 0003:2006:0118.000E: force feedback init failed [ 421.578960][ T5882] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 421.770810][ T5882] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 421.818282][ T5882] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 421.888266][ T5882] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 421.903198][T10240] netlink: 4 bytes leftover after parsing attributes in process `syz.3.877'. [ 421.940927][ T5882] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 422.023281][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 422.068200][ T5882] usb 2-1: Product: syz [ 422.078313][ T5882] usb 2-1: Manufacturer: syz [ 422.083003][ T5882] usb 2-1: SerialNumber: syz [ 422.256105][T10243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.268993][T10243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.327055][T10234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.346469][T10234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.379873][ T5940] usb 1-1: USB disconnect, device number 33 [ 422.426468][ T5882] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 26 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 422.668818][T10245] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 423.166435][T10262] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 424.298975][ T5921] usb 2-1: USB disconnect, device number 26 [ 424.324637][ T5921] usblp0: removed [ 425.168322][ T5921] usb 2-1: new full-speed USB device number 27 using dummy_hcd [ 425.361242][ T5921] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 425.385089][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.465482][ T5921] usb 2-1: config 0 descriptor?? [ 425.489653][ T5921] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 425.827218][T10290] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 426.178104][ T5921] gp8psk: usb in 138 operation failed. [ 426.187743][ T5921] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 426.187819][T10275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.203367][ T5921] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 426.389608][T10275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.742465][ T5921] usb 2-1: USB disconnect, device number 27 [ 427.502569][T10314] net_ratelimit: 179 callbacks suppressed [ 427.502594][T10314] netlink: zone id is out of range [ 427.513886][T10314] netlink: zone id is out of range [ 427.519117][T10314] netlink: zone id is out of range [ 427.524699][T10314] netlink: zone id is out of range [ 427.530089][T10314] netlink: zone id is out of range [ 427.535233][T10314] netlink: zone id is out of range [ 427.540461][T10314] netlink: zone id is out of range [ 427.545600][T10314] netlink: zone id is out of range [ 427.550963][T10314] netlink: zone id is out of range [ 427.556099][T10314] netlink: zone id is out of range [ 427.629338][T10316] netlink: 4 bytes leftover after parsing attributes in process `syz.2.893'. [ 427.896016][T10321] netlink: 8 bytes leftover after parsing attributes in process `syz.3.894'. [ 428.538312][ T5896] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 428.638564][ T5921] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 428.722105][ T5896] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 428.738753][T10333] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 428.746190][ T5896] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 428.779863][ T5896] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 428.822044][ T5921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 428.859109][ T5921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.878620][ T5921] usb 2-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 428.878835][ T5896] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 428.897045][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.930082][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 428.939549][ T5921] usb 2-1: config 0 descriptor?? [ 428.968580][ T5896] usb 4-1: Product: syz [ 428.972860][ T5896] usb 4-1: Manufacturer: syz [ 428.977505][ T5896] usb 4-1: SerialNumber: syz [ 429.217206][T10327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.239010][T10327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.272686][ T5896] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 31 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 429.353156][ T5921] hkems 0003:2006:0118.000F: ignoring exceeding usage max [ 429.380143][ T5921] hkems 0003:2006:0118.000F: hidraw0: USB HID v0.00 Device [HID 2006:0118] on usb-dummy_hcd.1-1/input0 [ 429.409464][ T5921] hkems 0003:2006:0118.000F: no inputs found [ 429.430259][ T5921] hkems 0003:2006:0118.000F: force feedback init failed [ 430.352982][T10329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.363061][T10329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.406325][ T5896] usb 2-1: USB disconnect, device number 28 [ 431.297710][ T5896] usb 4-1: USB disconnect, device number 31 [ 431.376076][ T5896] usblp0: removed [ 431.515894][ T5940] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 431.748766][T10378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.909'. [ 431.858991][ T5896] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 431.918700][ T5940] usb 1-1: Using ep0 maxpacket: 16 [ 431.925772][ T5940] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 431.934016][ T5940] usb 1-1: config 0 has no interface number 0 [ 431.940573][ T5940] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 431.952748][ T5940] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 431.990194][ T5940] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 432.003335][ T5940] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 432.014924][ T5940] usb 1-1: Product: syz [ 432.035252][ T5940] usb 1-1: SerialNumber: syz [ 432.136143][ T5896] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.173440][ T5940] usb 1-1: config 0 descriptor?? [ 432.210256][ T5940] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 432.389823][ T5896] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.413254][ T5896] usb 4-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 432.432602][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.471268][ T5940] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input23 [ 432.479188][ T5896] usb 4-1: config 0 descriptor?? [ 432.529604][T10364] netlink: 'syz.0.908': attribute type 16 has an invalid length. [ 432.563608][T10364] netlink: 3194 bytes leftover after parsing attributes in process `syz.0.908'. [ 432.656784][T10364] binder: 10363:10364 ioctl c0306201 200000000640 returned -22 [ 432.869954][T10364] binder: 10363:10364 ioctl 8008f511 200000000280 returned -22 [ 432.906913][ T5896] hkems 0003:2006:0118.0010: ignoring exceeding usage max [ 432.984003][ T5896] hkems 0003:2006:0118.0010: hidraw0: USB HID v0.00 Device [HID 2006:0118] on usb-dummy_hcd.3-1/input0 [ 433.010868][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 433.011310][ T24] usb 1-1: USB disconnect, device number 34 [ 433.018432][ C0] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 433.058348][ T5896] hkems 0003:2006:0118.0010: no inputs found [ 433.076737][ T5896] hkems 0003:2006:0118.0010: force feedback init failed [ 433.181507][ T24] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 433.577480][T10392] netlink: 80 bytes leftover after parsing attributes in process `syz.1.916'. [ 433.908285][ T5823] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 434.101843][ T5823] usb 2-1: Using ep0 maxpacket: 32 [ 434.114283][ T5823] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 434.138477][ T5823] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 434.170338][ T5823] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 434.303278][ T5823] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 434.505464][T10370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.509013][ T5823] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 434.514669][T10370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.559335][ T5823] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.569451][ T5823] usb 2-1: Product: syz [ 434.578066][ T5823] usb 2-1: Manufacturer: syz [ 434.588252][ T5823] usb 2-1: SerialNumber: syz [ 434.616828][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 434.627585][ T5823] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input24 [ 434.685601][ T5882] usb 4-1: USB disconnect, device number 32 [ 435.018233][ T5823] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 435.046910][ T5823] (id 0x00) [ 435.168466][ T5823] rc_core: IR keymap rc-imon-pad not found [ 435.175294][ T5823] Registered IR keymap rc-empty [ 435.184172][ T5823] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 435.195469][ T5823] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 435.267545][ T5823] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 435.340753][ T5882] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 435.357347][ T5823] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input25 [ 435.423051][ T5823] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:29> initialized [ 435.498760][ T5882] usb 5-1: Using ep0 maxpacket: 32 [ 435.518354][ T5882] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 435.528754][ T5882] usb 5-1: config 0 has no interface number 0 [ 435.557574][ T5882] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 435.599777][ T5882] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 435.622521][ T5882] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 435.632808][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.674670][ T5882] usb 5-1: Product: syz [ 435.695144][ T5882] usb 5-1: Manufacturer: syz [ 435.703635][ T5882] usb 5-1: SerialNumber: syz [ 435.737248][ T5882] usb 5-1: config 0 descriptor?? [ 435.825671][ T24] usb 2-1: USB disconnect, device number 29 [ 436.120909][T10420] netlink: 4 bytes leftover after parsing attributes in process `syz.3.922'. [ 436.159362][ T5926] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 436.175584][ T5882] radio-si470x 5-1:0.35: si470x_get_report: usb_control_msg returned -71 [ 436.205129][ T5882] radio-si470x 5-1:0.35: probe with driver radio-si470x failed with error -5 [ 436.254810][ T5882] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 436.340535][ T5926] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 436.361316][ T5926] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 436.384330][ T5882] usb 5-1: USB disconnect, device number 37 [ 436.385189][ T5926] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 436.416864][ T5834] Bluetooth: hci4: unexpected event for opcode 0x1009 [ 436.445447][ T5926] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 436.462195][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 436.473219][ T5926] usb 3-1: Product: syz [ 436.477439][ T5926] usb 3-1: Manufacturer: syz [ 436.484099][ T5926] usb 3-1: SerialNumber: syz [ 436.711611][T10415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.751593][T10415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.794415][T10432] netlink: 16 bytes leftover after parsing attributes in process `syz.0.925'. [ 436.865314][ T5926] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 438.269121][ T5921] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 438.438360][ T5921] usb 5-1: Using ep0 maxpacket: 16 [ 438.470416][ T5921] usb 5-1: config 0 has an invalid interface number: 4 but max is 0 [ 438.496039][ T5921] usb 5-1: config 0 has no interface number 0 [ 438.518349][ T5921] usb 5-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.606498][ T5921] usb 5-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.634531][ T5921] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 438.675916][ T5921] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.704723][ T5921] usb 5-1: config 0 descriptor?? [ 438.818698][ T5882] usb 2-1: new low-speed USB device number 30 using dummy_hcd [ 438.882585][ T5896] usb 3-1: USB disconnect, device number 25 [ 438.921660][ T5896] usblp0: removed [ 439.031469][ T5882] usb 2-1: unable to get BOS descriptor or descriptor too short [ 439.075547][ T5882] usb 2-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 439.186109][T10445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.211746][T10462] netlink: 12 bytes leftover after parsing attributes in process `syz.2.932'. [ 439.228300][ T30] audit: type=1326 audit(1772318693.318:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 439.228618][ T5882] usb 2-1: config 1 interface 0 has no altsetting 0 [ 439.287697][ T30] audit: type=1326 audit(1772318693.318:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 439.318933][T10445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.392495][ T5882] usb 2-1: string descriptor 0 read error: -22 [ 439.399110][ T5882] usb 2-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 439.411456][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.520655][ T30] audit: type=1326 audit(1772318693.318:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 439.616477][ T30] audit: type=1326 audit(1772318693.318:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.078276][ T30] audit: type=1326 audit(1772318693.318:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.114391][ T5921] hid (null): global environment stack underflow [ 440.131432][ T5921] hid (null): report_id 3266724546 is invalid [ 440.148017][ T5921] hid (null): unknown global tag 0xe [ 440.169346][ T5921] hid (null): invalid report_size 6157 [ 440.173689][ T5882] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input26 [ 440.219337][ T5921] hid (null): unknown global tag 0xd [ 440.264968][ T30] audit: type=1326 audit(1772318693.318:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.265421][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.308452][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.478377][ T5834] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 440.487329][ T5834] Bluetooth: hci4: Injecting HCI hardware error event [ 440.509965][ T5834] Bluetooth: hci4: hardware error 0x00 [ 440.660732][ T30] audit: type=1326 audit(1772318693.318:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.774240][ T30] audit: type=1326 audit(1772318693.388:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.830753][ T30] audit: type=1326 audit(1772318693.388:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 440.917087][ T30] audit: type=1326 audit(1772318693.418:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10458 comm="syz.2.932" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f716999c799 code=0x7ffc0000 [ 441.083088][ T5921] usb 5-1: USB disconnect, device number 38 [ 441.115981][ T5177] bcm5974 2-1:1.0: could not read from device [ 441.116774][ T5882] usb 2-1: USB disconnect, device number 30 [ 441.133079][ T6505] bcm5974 2-1:1.0: could not read from device [ 441.861603][T10482] netlink: 4 bytes leftover after parsing attributes in process `syz.1.936'. [ 441.881275][T10492] netlink: 12 bytes leftover after parsing attributes in process `syz.3.935'. [ 442.768287][ T5926] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 443.012575][ T5926] usb 1-1: Using ep0 maxpacket: 32 [ 443.020747][ T5926] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 443.031021][ T5926] usb 1-1: config 0 has no interface number 0 [ 443.062904][ T5834] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 443.076983][ T5926] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 443.088650][ T5926] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 443.150595][ T5926] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 443.218515][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.232741][ T5926] usb 1-1: Product: syz [ 443.237035][ T5926] usb 1-1: Manufacturer: syz [ 443.251797][ T5926] usb 1-1: SerialNumber: syz [ 443.318494][ T5896] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 443.483851][ T5926] usb 1-1: config 0 descriptor?? [ 443.758461][ T5896] usb 4-1: Using ep0 maxpacket: 8 [ 443.869109][ T5896] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 443.888202][ T5896] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 443.908611][ T5896] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 443.995571][ T5896] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 444.015966][ T5926] radio-si470x 1-1:0.35: si470x_get_report: usb_control_msg returned -71 [ 444.035438][ T5926] radio-si470x 1-1:0.35: probe with driver radio-si470x failed with error -5 [ 444.054868][ T5896] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 444.068107][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.089638][ T5926] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 444.148615][ T5926] usb 1-1: USB disconnect, device number 35 [ 444.215748][T10525] net_ratelimit: 366 callbacks suppressed [ 444.215766][T10525] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check. [ 444.517625][ T5896] usb 4-1: GET_CAPABILITIES returned 0 [ 444.539061][ T5896] usbtmc 4-1:16.0: can't read capabilities [ 444.613541][T10530] netlink: 'syz.4.948': attribute type 33 has an invalid length. [ 444.638092][T10532] netlink: 14 bytes leftover after parsing attributes in process `syz.4.948'. [ 444.648105][T10530] netlink: 152 bytes leftover after parsing attributes in process `syz.4.948'. [ 444.734202][ T5823] usb 4-1: USB disconnect, device number 33 [ 444.748522][ T5882] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 444.820886][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 444.820908][ T30] audit: type=1326 audit(1772318698.918:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10535 comm="syz.4.950" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc69b19c799 code=0x0 [ 444.948758][ T5882] usb 3-1: unable to get BOS descriptor or descriptor too short [ 444.960681][ T5882] usb 3-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 444.974155][ T5882] usb 3-1: config 1 interface 0 has no altsetting 0 [ 445.001893][ T5882] usb 3-1: string descriptor 0 read error: -22 [ 445.009874][ T5882] usb 3-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 445.022066][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.111912][ T5882] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input27 [ 445.247505][T10547] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 445.469590][ T5177] bcm5974 3-1:1.0: could not read from device [ 445.488070][ T5177] bcm5974 3-1:1.0: could not read from device [ 445.499128][ T5882] usb 3-1: USB disconnect, device number 26 [ 445.521808][ T5177] bcm5974 3-1:1.0: could not read from device [ 445.548886][ T7213] bcm5974 3-1:1.0: could not read from device [ 445.573806][ T5177] bcm5974 3-1:1.0: could not read from device [ 445.862924][ T30] audit: type=1804 audit(1772318699.968:372): pid=10541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.950" name="/newroot/174/file1" dev="tmpfs" ino=916 res=1 errno=0 [ 446.444597][T10574] syz_tun: entered allmulticast mode [ 446.759163][T10572] netlink: 20 bytes leftover after parsing attributes in process `syz.2.957'. [ 446.917620][ T5823] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 447.158254][ T5882] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 447.270301][ T5823] usb 1-1: config 0 has no interfaces? [ 447.307849][ T5823] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 447.317290][ T5823] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 447.336174][ T5823] usb 1-1: Manufacturer: syz [ 447.358084][ T5823] usb 1-1: config 0 descriptor?? [ 447.386224][ T5882] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 447.404001][ T5882] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 447.421983][ T5882] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 447.446446][ T5882] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 447.463518][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 447.471862][ T5882] usb 5-1: Product: syz [ 447.476388][ T5882] usb 5-1: Manufacturer: syz [ 447.481276][ T5882] usb 5-1: SerialNumber: syz [ 447.630052][T10576] netlink: 4 bytes leftover after parsing attributes in process `syz.0.958'. [ 447.716127][T10576] syz_tun (unregistering): left allmulticast mode [ 447.717882][T10581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 447.738928][T10581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 447.788369][ T5882] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 39 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 448.338229][ T5882] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 448.498287][ T5882] usb 2-1: Using ep0 maxpacket: 8 [ 448.505646][ T5882] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 448.517561][ T5882] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 448.528825][ T5882] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 448.539326][ T5882] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 448.552508][ T5882] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 448.562141][ T5882] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.589859][ T5896] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 448.748290][ T5896] usb 4-1: Using ep0 maxpacket: 32 [ 448.755947][ T5896] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 448.764355][ T5896] usb 4-1: config 0 has no interface number 0 [ 448.770814][ T5896] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 448.776286][ T5882] usb 2-1: GET_CAPABILITIES returned 0 [ 448.782277][ T5896] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 448.799052][ T5882] usbtmc 2-1:16.0: can't read capabilities [ 448.803430][ T5896] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 448.815096][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.824411][ T5896] usb 4-1: Product: syz [ 448.836480][ T5896] usb 4-1: Manufacturer: syz [ 448.843066][ T5896] usb 4-1: SerialNumber: syz [ 448.857761][ T5896] usb 4-1: config 0 descriptor?? [ 448.985554][ T5882] usb 2-1: USB disconnect, device number 31 [ 449.272885][ T5882] usb 1-1: USB disconnect, device number 36 [ 449.277017][ T5896] radio-si470x 4-1:0.35: si470x_get_report: usb_control_msg returned -71 [ 449.349004][ T5896] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 449.413062][ T5896] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 449.460718][ T5896] usb 4-1: USB disconnect, device number 34 [ 449.832827][ T5926] usb 5-1: USB disconnect, device number 39 [ 449.863858][ T5926] usblp0: removed [ 450.059356][ T30] audit: type=1804 audit(1772318704.148:373): pid=10614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.969" name="bus" dev="ramfs" ino=32890 res=1 errno=0 [ 450.559052][ T5926] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 450.740834][ T5926] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.764636][ T5926] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.838470][ T5926] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 450.867667][ T5926] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 450.903961][ T5823] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 450.921847][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.956055][ T5926] usb 5-1: config 0 descriptor?? [ 450.998008][T10626] bond4: entered promiscuous mode [ 451.458278][ T5926] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 451.537074][ T5823] usb 4-1: Using ep0 maxpacket: 8 [ 451.615683][ T5823] usb 4-1: config 6 has an invalid interface number: 2 but max is 0 [ 451.638230][ T5823] usb 4-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 451.678333][ T5823] usb 4-1: config 6 has no interface number 0 [ 451.691882][ T5823] usb 4-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 451.885752][ T5823] usb 4-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 451.895498][ T5823] usb 4-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 451.906974][ T5926] usb 5-1: USB disconnect, device number 40 [ 452.029203][ T5823] usb 4-1: Product: syz [ 452.034124][ T5823] usb 4-1: Manufacturer: syz [ 452.089099][ T5823] usb 4-1: SerialNumber: syz [ 452.146596][ T5823] hso 4-1:6.2: Failed to find INT IN ep [ 452.672015][ T5823] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 452.953434][ T5823] usb 1-1: Using ep0 maxpacket: 8 [ 453.607330][ T5823] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 453.627410][ T5823] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 453.647906][ T5823] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 453.678297][ T5823] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 453.968413][ T5823] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 454.009695][ T5823] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.498428][ T5823] usb 1-1: GET_CAPABILITIES returned 0 [ 454.504008][ T5823] usbtmc 1-1:16.0: can't read capabilities [ 454.561111][ T5921] usb 4-1: USB disconnect, device number 35 [ 454.624001][ T5926] usb 1-1: USB disconnect, device number 37 [ 455.178513][ T5882] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 455.318438][ T5882] usb 4-1: device descriptor read/64, error -71 [ 455.625559][ T5882] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 455.681230][T10690] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 455.797892][ T5882] usb 4-1: device descriptor read/64, error -71 [ 455.978556][ T5882] usb usb4-port1: attempt power cycle [ 456.436609][ T5882] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 456.479114][ T5882] usb 4-1: device descriptor read/8, error -71 [ 456.569954][ T5926] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 456.728272][ T5882] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 456.728332][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 456.745307][ T5926] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 456.775457][ T5882] usb 4-1: device descriptor read/8, error -71 [ 456.781007][ T5926] usb 5-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 456.793673][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.801890][ T5926] usb 5-1: Product: syz [ 456.806340][ T5926] usb 5-1: Manufacturer: syz [ 456.811108][ T5926] usb 5-1: SerialNumber: syz [ 456.817695][ T5926] usb 5-1: config 0 descriptor?? [ 456.991322][ T5926] usb 5-1: bad CDC descriptors [ 456.998088][ T5926] usb 5-1: unsupported MDLM descriptors [ 457.098793][ T5882] usb usb4-port1: unable to enumerate USB device [ 457.334382][T10694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.366277][T10694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.402442][ T5940] usb 5-1: USB disconnect, device number 41 [ 457.653446][ T5882] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 457.902664][ T5882] usb 2-1: config 0 has an invalid interface number: 30 but max is 0 [ 457.928343][ T5882] usb 2-1: config 0 has no interface number 0 [ 458.011363][ T5882] usb 2-1: config 0 interface 30 has no altsetting 0 [ 458.083039][ T5882] usb 2-1: New USB device found, idVendor=06cd, idProduct=0109, bcdDevice=25.04 [ 458.092859][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.144228][ T5882] usb 2-1: Product: syz [ 458.163464][ T5882] usb 2-1: Manufacturer: syz [ 458.188213][ T5882] usb 2-1: SerialNumber: syz [ 458.291955][ T5882] usb 2-1: config 0 descriptor?? [ 458.385212][ T5882] hub 2-1:0.30: bad descriptor, ignoring hub [ 458.413401][ T5882] hub 2-1:0.30: probe with driver hub failed with error -5 [ 458.430351][ T5882] keyspan 2-1:0.30: Keyspan - (without firmware) converter detected [ 458.677887][ T5926] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 458.702203][ T5882] usb 2-1: USB disconnect, device number 32 [ 458.720561][ T5882] keyspan 2-1:0.30: device disconnected [ 458.954651][ T5926] usb 5-1: Using ep0 maxpacket: 8 [ 458.980411][ T5926] usb 5-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 459.019372][ T5926] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 459.048218][ T5926] usb 5-1: config 1 interface 1 has no altsetting 0 [ 459.082585][ T5926] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 459.092252][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.115882][ T5926] usb 5-1: Product: syz [ 459.131405][ T5926] usb 5-1: Manufacturer: syz [ 459.144986][ T5926] usb 5-1: SerialNumber: syz [ 459.498083][ T5926] usb 5-1: USB disconnect, device number 42 [ 459.876307][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 460.541224][T10741] warning: `syz.4.998' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 460.631824][T10743] Cannot find del_set index 2 as target [ 461.156188][T10752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1003'. [ 465.080974][T10810] Cannot find del_set index 2 as target [ 465.174336][T10804] netlink: zone id is out of range [ 465.180855][T10804] netlink: zone id is out of range [ 465.186088][T10804] netlink: zone id is out of range [ 465.191827][T10804] netlink: zone id is out of range [ 465.198578][T10804] netlink: zone id is out of range [ 465.203867][T10804] netlink: zone id is out of range [ 465.209425][T10804] netlink: zone id is out of range [ 465.214697][T10804] netlink: zone id is out of range [ 465.225605][T10804] netlink: zone id is out of range [ 465.245137][T10804] netlink: zone id is out of range [ 465.348267][ T5896] usb 4-1: new low-speed USB device number 40 using dummy_hcd [ 465.553024][ T5896] usb 4-1: unable to get BOS descriptor or descriptor too short [ 465.569858][ T5896] usb 4-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 465.590207][ T5896] usb 4-1: config 1 interface 0 has no altsetting 0 [ 465.602469][ T5896] usb 4-1: string descriptor 0 read error: -22 [ 465.609407][ T5896] usb 4-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 465.637667][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.829659][ T5896] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input28 [ 466.680731][ T5177] bcm5974 4-1:1.0: could not read from device [ 466.681098][ T5823] usb 4-1: USB disconnect, device number 40 [ 466.728632][ T5177] bcm5974 4-1:1.0: could not read from device [ 466.895319][ T6505] bcm5974 4-1:1.0: could not read from device [ 467.041989][T10829] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1022'. [ 467.133121][ T5177] bcm5974 4-1:1.0: could not read from device [ 468.290044][T10843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1026'. [ 469.037359][T10848] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1027'. [ 470.547175][T10862] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1030'. [ 471.305687][T10871] Cannot find del_set index 2 as target [ 472.542426][ T5882] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 472.931757][ T5882] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 472.958186][ T5882] usb 1-1: config 0 has no interface number 0 [ 472.989453][ T5882] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 473.018999][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.061945][ T5882] usb 1-1: Product: syz [ 473.086760][ T5882] usb 1-1: Manufacturer: syz [ 473.108272][ T5882] usb 1-1: SerialNumber: syz [ 473.135396][ T5882] usb 1-1: config 0 descriptor?? [ 473.233819][T10904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1037'. [ 473.315868][T10906] fuse: Unknown parameter '€' [ 473.352988][ T5882] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 473.399187][ T5882] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 473.434607][ T5882] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 473.451892][ T5882] usb 1-1: media controller created [ 473.469412][T10907] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 473.500263][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 474.745122][ T5882] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 474.919995][ T5882] usb 1-1: USB disconnect, device number 38 [ 475.038322][ T5896] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 475.232759][ T5896] usb 4-1: config 0 has no interfaces? [ 475.262548][ T5896] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 475.279787][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.292062][ T5896] usb 4-1: Product: syz [ 475.296278][ T5896] usb 4-1: Manufacturer: syz [ 475.301534][ T5896] usb 4-1: SerialNumber: syz [ 475.321945][ T5896] usb 4-1: config 0 descriptor?? [ 475.883390][T10923] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.890192][T10934] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1044'. [ 476.016197][ T5896] usb 4-1: USB disconnect, device number 41 [ 477.035193][T10944] Cannot find del_set index 2 as target [ 477.722239][T10954] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1049'. [ 478.430902][ T30] audit: type=1326 audit(1772318732.538:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10974 comm="syz.2.1052" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f716999c799 code=0x0 [ 478.787755][T10986] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1053'. [ 479.071396][ T5896] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 479.290825][ T5896] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 479.338294][ T5896] usb 1-1: config 0 has no interface number 0 [ 479.412378][ T5896] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 479.464866][ T5896] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.501017][ T5896] usb 1-1: Product: syz [ 479.505333][ T5896] usb 1-1: Manufacturer: syz [ 479.533475][ T5896] usb 1-1: SerialNumber: syz [ 479.555093][ T5896] usb 1-1: config 0 descriptor?? [ 479.788929][ T5896] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 479.841492][ T5896] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 479.898795][ T5896] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 479.911678][ T5896] usb 1-1: media controller created [ 479.972411][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 480.201384][ T5896] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 480.335097][ T30] audit: type=1804 audit(1772318734.438:375): pid=10982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1052" name="/newroot/222/file1" dev="tmpfs" ino=1173 res=1 errno=0 [ 480.410051][ T5896] usb 1-1: USB disconnect, device number 39 [ 480.723420][T11017] netlink: 'syz.4.1059': attribute type 1 has an invalid length. [ 480.915464][T11025] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1063'. [ 481.820576][ T5921] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 481.944251][T11053] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1068'. [ 482.035534][ T5921] usb 2-1: Using ep0 maxpacket: 16 [ 482.086291][ T5921] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 17408, setting to 1024 [ 482.107963][ T5921] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 482.283021][ T5921] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 482.336547][ T5921] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 482.347199][ T5921] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 482.367867][ T5921] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 482.378004][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 482.386190][ T5921] usb 2-1: SerialNumber: syz [ 482.393338][T11046] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 482.401400][T11046] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 484.351798][T11040] Cannot find del_set index 2 as target [ 484.528465][ T5823] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 485.171324][ T5823] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 485.203467][ T5823] usb 1-1: config 0 has no interface number 0 [ 485.250039][ T5823] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 485.274148][ T5823] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.479637][ T5823] usb 1-1: Product: syz [ 485.488273][ T5823] usb 1-1: Manufacturer: syz [ 485.492902][ T5823] usb 1-1: SerialNumber: syz [ 485.553580][ T5823] usb 1-1: config 0 descriptor?? [ 485.719756][ T5921] usb 2-1: USB disconnect, device number 33 [ 485.773802][ T5823] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 485.853588][ T5823] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 485.911961][ T5823] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 485.929442][ T5823] usb 1-1: media controller created [ 485.973481][ T5823] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 485.989149][T11086] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1074'. [ 486.138357][ T5823] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 486.359384][ T5823] usb 1-1: USB disconnect, device number 40 [ 488.246445][T11117] net_ratelimit: 178 callbacks suppressed [ 488.246471][T11117] netlink: zone id is out of range [ 488.285757][T11117] netlink: zone id is out of range [ 488.295031][T11117] netlink: zone id is out of range [ 488.303905][T11117] netlink: zone id is out of range [ 488.325282][T11117] netlink: zone id is out of range [ 488.364000][T11117] netlink: zone id is out of range [ 488.374228][T11117] netlink: zone id is out of range [ 488.403204][T11117] netlink: zone id is out of range [ 488.410426][T11117] netlink: zone id is out of range [ 488.448345][ T5823] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 488.451401][T11117] netlink: zone id is out of range [ 488.578201][ T5882] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 488.639517][ T5823] usb 1-1: Using ep0 maxpacket: 8 [ 488.647865][ T5823] usb 1-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 488.668306][ T5823] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 488.708326][ T5823] usb 1-1: config 1 interface 1 has no altsetting 0 [ 488.717578][ T5823] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 488.748003][ T5823] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.760827][ T5882] usb 2-1: unable to get BOS descriptor or descriptor too short [ 488.778346][ T5823] usb 1-1: Product: syz [ 488.782649][ T5823] usb 1-1: Manufacturer: syz [ 488.787438][ T5882] usb 2-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 488.808416][ T5823] usb 1-1: SerialNumber: syz [ 488.835001][ T5882] usb 2-1: config 1 interface 0 has no altsetting 0 [ 488.867707][ T5882] usb 2-1: string descriptor 0 read error: -22 [ 488.897798][ T5882] usb 2-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 488.930800][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.983666][T11137] Cannot find del_set index 2 as target [ 489.034498][ T5882] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input30 [ 489.199151][ T5823] usb 1-1: USB disconnect, device number 41 [ 489.356810][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 489.384150][ T5897] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 489.431274][ T5177] bcm5974 2-1:1.0: could not read from device [ 489.442380][ T5177] bcm5974 2-1:1.0: could not read from device [ 489.461441][ T5177] bcm5974 2-1:1.0: could not read from device [ 489.474194][ T5177] bcm5974 2-1:1.0: could not read from device [ 489.535411][ T5882] usb 2-1: USB disconnect, device number 34 [ 489.548547][ T6505] bcm5974 2-1:1.0: could not read from device [ 489.568220][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 489.578222][ T5897] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 17408, setting to 1024 [ 489.608362][ T5897] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 489.674570][ T5897] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 489.703906][ T5897] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 489.709663][T11149] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1086'. [ 489.793029][ T5897] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 489.882609][ T5897] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 489.902295][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 489.921422][ T5897] usb 3-1: SerialNumber: syz [ 490.060277][T11140] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 490.081876][T11140] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 490.618347][ T5896] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 490.774789][ T5896] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 490.806437][ T5896] usb 2-1: config 0 has no interface number 0 [ 490.825145][ T5896] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 490.849443][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.867393][ T5940] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 490.877462][ T5896] usb 2-1: Product: syz [ 490.886375][ T5896] usb 2-1: Manufacturer: syz [ 490.906647][ T5896] usb 2-1: SerialNumber: syz [ 490.928019][ T5896] usb 2-1: config 0 descriptor?? [ 490.953325][T11162] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1091'. [ 490.983768][T11162] xt_recent: Unsupported userspace flags (000000de) [ 491.171551][ T5940] usb 1-1: Using ep0 maxpacket: 16 [ 491.184478][ T5940] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 491.194906][ T5940] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 491.228222][ T5940] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 491.250747][ T5940] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 491.261059][ T5940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.276978][ T5940] usb 1-1: Product: syz [ 491.283965][ T5940] usb 1-1: Manufacturer: syz [ 491.289825][ T5940] usb 1-1: SerialNumber: syz [ 491.328380][ T5896] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 491.576156][ T5896] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 491.604585][ T5896] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 491.625030][ T5896] usb 2-1: media controller created [ 491.672374][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 491.994255][ T5940] usb 1-1: 0:2 : does not exist [ 492.028318][ T5940] usb 1-1: 1:0: cannot get min/max values for control 4 (id 1) [ 492.239838][ T5940] usb 1-1: USB disconnect, device number 42 [ 492.263616][ T5896] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 492.362628][ T6505] udevd[6505]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 492.521848][ T5896] usb 2-1: USB disconnect, device number 35 [ 492.718559][ T5897] usb 3-1: USB disconnect, device number 27 [ 493.573119][T11190] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1097'. [ 493.718256][ T5921] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 493.928287][ T5921] usb 4-1: Using ep0 maxpacket: 8 [ 493.935928][ T5921] usb 4-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 493.988808][ T5921] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 494.013788][ T5921] usb 4-1: config 1 interface 1 has no altsetting 0 [ 494.018502][ T5897] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 494.023350][ T5921] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 494.037687][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.048220][ T5921] usb 4-1: Product: syz [ 494.052426][ T5921] usb 4-1: Manufacturer: syz [ 494.057281][ T5921] usb 4-1: SerialNumber: syz [ 494.179820][ T5897] usb 5-1: Using ep0 maxpacket: 8 [ 494.193166][ T5897] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 494.206841][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.215447][ T5897] usb 5-1: Product: syz [ 494.220358][ T5897] usb 5-1: Manufacturer: syz [ 494.225349][ T5897] usb 5-1: SerialNumber: syz [ 494.236390][T11214] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1101'. [ 494.248888][ T5897] usb 5-1: config 0 descriptor?? [ 494.380518][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1100'. [ 494.428708][ T5921] usb 4-1: USB disconnect, device number 42 [ 494.469912][ T5897] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 495.006668][T11226] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1105'. [ 495.016794][T11226] bond1: option mode: invalid value (255) [ 495.205725][T11229] FAULT_INJECTION: forcing a failure. [ 495.205725][T11229] name failslab, interval 1, probability 0, space 0, times 0 [ 495.258350][T11229] CPU: 0 UID: 0 PID: 11229 Comm: syz.3.1106 Not tainted syzkaller #0 PREEMPT(full) [ 495.258380][T11229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 495.258391][T11229] Call Trace: [ 495.258399][T11229] [ 495.258407][T11229] dump_stack_lvl+0xe8/0x150 [ 495.258441][T11229] should_fail_ex+0x412/0x560 [ 495.258476][T11229] should_failslab+0xa8/0x100 [ 495.258498][T11229] ? vm_area_dup+0x2b/0x680 [ 495.258518][T11229] kmem_cache_alloc_noprof+0x87/0x650 [ 495.258555][T11229] vm_area_dup+0x2b/0x680 [ 495.258580][T11229] __split_vma+0x1dc/0xa40 [ 495.258608][T11229] ? mas_find+0xb0e/0xd30 [ 495.258647][T11229] ? __pfx___split_vma+0x10/0x10 [ 495.258688][T11229] ? __pfx___up_read+0x10/0x10 [ 495.258712][T11229] vms_gather_munmap_vmas+0x32d/0x1370 [ 495.258735][T11229] ? __mt_destroy+0x1c9/0x280 [ 495.258756][T11229] ? vms_complete_munmap_vmas+0xa0b/0xc60 [ 495.258793][T11229] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 495.258839][T11229] do_vmi_align_munmap+0x2b4/0x4b0 [ 495.258882][T11229] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 495.258941][T11229] do_vmi_munmap+0x252/0x2d0 [ 495.258973][T11229] __vm_munmap+0x22c/0x3d0 [ 495.259011][T11229] ? __pfx___vm_munmap+0x10/0x10 [ 495.259035][T11229] ? vm_mmap_pgoff+0x3b1/0x4f0 [ 495.259074][T11229] ? rcu_is_watching+0x15/0xb0 [ 495.259111][T11229] __x64_sys_munmap+0x60/0x70 [ 495.259141][T11229] do_syscall_64+0x14d/0xf80 [ 495.259158][T11229] ? trace_irq_disable+0x3b/0x150 [ 495.259186][T11229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.259207][T11229] ? clear_bhb_loop+0x40/0x90 [ 495.259232][T11229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.259250][T11229] RIP: 0033:0x7fea5a19c5c7 [ 495.259269][T11229] Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.259286][T11229] RSP: 002b:00007fea5b072d18 EFLAGS: 00000206 ORIG_RAX: 000000000000000b [ 495.259308][T11229] RAX: ffffffffffffffda RBX: 00007fea54000000 RCX: 00007fea5a19c5c7 [ 495.259322][T11229] RDX: 0000000000000000 RSI: 0000000000200000 RDI: 00007fea58000000 [ 495.259335][T11229] RBP: 0000000000021000 R08: 00000000ffffffff R09: 0000000000000000 [ 495.259347][T11229] R10: 0000000000000022 R11: 0000000000000206 R12: 0000000004000000 [ 495.259360][T11229] R13: 0000000000001000 R14: 00007fea58000000 R15: 0000000003e00000 [ 495.259392][T11229] [ 495.288305][ T5921] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 495.711150][ T5921] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 495.729212][ T5921] usb 2-1: config 0 has no interface number 0 [ 495.742401][ T5921] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 495.758382][ T5921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.785205][ T5921] usb 2-1: Product: syz [ 495.796712][ T5921] usb 2-1: Manufacturer: syz [ 495.832051][ T5921] usb 2-1: SerialNumber: syz [ 495.843766][ T5921] usb 2-1: config 0 descriptor?? [ 495.976910][T11239] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1109'. [ 496.064948][ T5921] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 496.077085][ T5921] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 496.102182][ T5921] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 496.137754][ T5921] usb 2-1: media controller created [ 496.208414][ T5921] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 496.778910][ T5921] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 496.895737][ T5921] usb 2-1: USB disconnect, device number 36 [ 496.968895][ T5897] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 497.338949][ T5896] usb 5-1: USB disconnect, device number 43 [ 497.597367][T11255] Cannot find del_set index 2 as target [ 497.731156][T11259] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1114'. [ 498.181123][ T30] audit: type=1326 audit(1772318752.288:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11269 comm="syz.1.1118" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9a5259c799 code=0x0 [ 498.205919][ T5921] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 498.389400][ T5896] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 498.397015][ T5921] usb 3-1: Using ep0 maxpacket: 8 [ 498.422685][ T5921] usb 3-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 498.422767][ T5921] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 498.422797][ T5921] usb 3-1: config 1 interface 1 has no altsetting 0 [ 498.424977][ T5921] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 498.425005][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.425026][ T5921] usb 3-1: Product: syz [ 498.425041][ T5921] usb 3-1: Manufacturer: syz [ 498.425057][ T5921] usb 3-1: SerialNumber: syz [ 498.553411][ T5896] usb 1-1: device descriptor read/64, error -71 [ 498.788237][ T5896] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 498.838439][ T5921] usb 3-1: USB disconnect, device number 28 [ 498.925898][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 498.961335][ T5896] usb 1-1: device descriptor read/64, error -71 [ 499.129073][ T5896] usb usb1-port1: attempt power cycle [ 499.179247][ T5940] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 499.341459][ T5940] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 499.351546][ T5940] usb 5-1: config 0 has no interface number 0 [ 499.364918][ T5940] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 499.376982][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.391130][ T5940] usb 5-1: Product: syz [ 499.400096][ T5940] usb 5-1: Manufacturer: syz [ 499.413456][ T5940] usb 5-1: SerialNumber: syz [ 499.431626][ T5940] usb 5-1: config 0 descriptor?? [ 499.451952][ T30] audit: type=1804 audit(1772318753.558:377): pid=11275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1118" name="/newroot/233/file1" dev="tmpfs" ino=1230 res=1 errno=0 [ 499.482599][ T5896] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 499.520518][ T5896] usb 1-1: device descriptor read/8, error -71 [ 499.652029][ T5940] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 499.706495][ T5940] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 499.753827][ T5940] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 499.786762][ T5940] usb 5-1: media controller created [ 499.818278][ T5896] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 499.839165][ T5896] usb 1-1: device descriptor read/8, error -71 [ 499.901573][ T5940] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 499.981508][ T5896] usb usb1-port1: unable to enumerate USB device [ 499.983636][ T5940] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 500.101302][ T5940] usb 5-1: USB disconnect, device number 44 [ 500.442100][T11314] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1127'. [ 500.909623][ T5882] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 501.160017][ T5882] usb 4-1: Using ep0 maxpacket: 16 [ 501.206443][ T5882] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 501.230766][ T5882] usb 4-1: config 0 has no interface number 0 [ 501.261015][ T5882] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.406163][ T5882] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 501.462993][ T5882] usb 4-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 501.518278][ T5921] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 501.518644][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.732004][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.746092][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.778796][ T5921] usb 3-1: Using ep0 maxpacket: 8 [ 501.796989][ T5921] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 501.816057][ T5882] usb 4-1: config 0 descriptor?? [ 501.826132][ T5921] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 501.860218][ T5921] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 501.902701][ T5921] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 501.955883][ T5921] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 501.989218][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.304710][ T5882] holtek_mouse 0003:04D9:A081.0013: item fetching failed at offset 5/8 [ 502.314814][ T5882] holtek_mouse 0003:04D9:A081.0013: hid parse failed: -22 [ 502.559149][ T5882] holtek_mouse 0003:04D9:A081.0013: probe with driver holtek_mouse failed with error -22 [ 502.627662][ T5921] usb 3-1: GET_CAPABILITIES returned 0 [ 502.628192][ T5897] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 502.643917][ T5921] usbtmc 3-1:16.0: can't read capabilities [ 502.657427][ T5921] usb 3-1: USB disconnect, device number 29 [ 502.909730][ T5897] usb 1-1: Using ep0 maxpacket: 8 [ 502.925150][ T5897] usb 1-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 502.940407][ T5897] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 502.976148][ T5897] usb 1-1: config 1 interface 1 has no altsetting 0 [ 502.992171][ T5897] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 503.006230][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.043225][ T5897] usb 1-1: Product: syz [ 503.050341][ T5897] usb 1-1: Manufacturer: syz [ 503.055992][ T5897] usb 1-1: SerialNumber: syz [ 503.188061][T11350] fuse: Bad value for 'fd' [ 503.345683][T11354] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1136'. [ 503.446708][ T5897] usb 1-1: USB disconnect, device number 47 [ 503.508291][ T5882] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 503.555219][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 503.679979][ T5882] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 503.689513][ T5882] usb 3-1: config 0 has no interface number 0 [ 503.715418][ T5882] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 503.734543][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.743750][ T5882] usb 3-1: Product: syz [ 503.748055][ T5882] usb 3-1: Manufacturer: syz [ 503.754662][ T5882] usb 3-1: SerialNumber: syz [ 503.792948][ T5882] usb 3-1: config 0 descriptor?? [ 503.982897][T11362] team0: Device vlan2 is already an upper device of the team interface [ 504.010169][ T5882] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 504.023782][ T5882] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 504.046284][ T5882] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 504.057469][ T5882] usb 3-1: media controller created [ 504.104362][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 504.168251][ T5823] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 504.248299][ T5921] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 504.308454][ T5823] usb 5-1: device descriptor read/64, error -71 [ 504.395199][ T5921] usb 1-1: device descriptor read/64, error -71 [ 504.453031][T11371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1142'. [ 504.523738][ T5897] usb 4-1: USB disconnect, device number 43 [ 504.558308][ T5823] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 504.658627][ T5921] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 504.708312][ T5823] usb 5-1: device descriptor read/64, error -71 [ 504.808303][ T5921] usb 1-1: device descriptor read/64, error -71 [ 504.829906][ T5823] usb usb5-port1: attempt power cycle [ 504.929507][ T5921] usb usb1-port1: attempt power cycle [ 505.230190][ T5823] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 505.239726][ T5882] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 505.267641][ T5823] usb 5-1: device descriptor read/8, error -71 [ 505.329564][ T5921] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 505.654391][ T5882] usb 3-1: USB disconnect, device number 30 [ 505.703828][ T5921] usb 1-1: device descriptor read/8, error -71 [ 505.773255][ T5823] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 505.828888][ T5823] usb 5-1: device descriptor read/8, error -71 [ 505.963039][ T5921] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 506.004050][ T5823] usb usb5-port1: unable to enumerate USB device [ 506.079000][ T5921] usb 1-1: device descriptor read/8, error -71 [ 506.213267][ T5921] usb usb1-port1: unable to enumerate USB device [ 506.541530][ T5823] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 506.670466][T11393] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 506.677424][T11393] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 506.706846][T11393] vhci_hcd vhci_hcd.0: Device attached [ 506.747990][ T5823] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 506.767589][ T5823] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.795943][ T5823] usb 3-1: config 0 descriptor?? [ 506.809700][ T5823] cp210x 3-1:0.0: cp210x converter detected [ 506.830289][T11393] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1145'. [ 507.008521][ T5921] usb 36-1: SetAddress Request (2) to port 0 [ 507.155388][ T5921] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 507.812569][ T5940] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 508.129971][ T5940] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 508.157377][ T5940] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.521177][ T5940] usb 1-1: config 0 descriptor?? [ 508.551132][ T5940] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 509.204384][ T5940] gp8psk: usb in 138 operation failed. [ 509.217647][T11407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.258812][T11407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.270156][ T5940] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 509.297430][ T5940] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 509.348305][ T5882] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 509.467516][ T796] usb 1-1: USB disconnect, device number 52 [ 509.521327][ T5882] usb 5-1: Using ep0 maxpacket: 8 [ 509.529406][ T5882] usb 5-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 509.550749][ T5882] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 509.570290][ T5882] usb 5-1: config 1 interface 1 has no altsetting 0 [ 509.587694][ T5882] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 509.598217][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.608225][ T5882] usb 5-1: Product: syz [ 509.620917][ T5882] usb 5-1: Manufacturer: syz [ 509.625620][ T5882] usb 5-1: SerialNumber: syz [ 509.769375][ T5896] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 509.826862][T11394] vhci_hcd: connection reset by peer [ 509.870524][ T1326] vhci_hcd vhci_hcd.1: stop threads [ 509.876978][ T1326] vhci_hcd vhci_hcd.1: release socket [ 509.942836][ T1326] vhci_hcd vhci_hcd.1: disconnect device [ 509.970590][ T5896] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 509.981488][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.019829][ T5896] usb 4-1: config 0 descriptor?? [ 510.056643][ T5896] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 510.064085][ T5882] usb 5-1: USB disconnect, device number 49 [ 510.216416][ T5823] cp210x 3-1:0.0: failed to get vendor val 0x370c size 13: -71 [ 510.224564][ T5823] cp210x 3-1:0.0: GPIO initialisation failed: -71 [ 510.276626][ T5823] usb 3-1: cp210x converter now attached to ttyUSB0 [ 510.303346][ T5823] usb 3-1: USB disconnect, device number 31 [ 510.321197][ T5823] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 510.321800][ T5823] cp210x 3-1:0.0: device disconnected [ 510.494559][T11425] FAULT_INJECTION: forcing a failure. [ 510.494559][T11425] name failslab, interval 1, probability 0, space 0, times 0 [ 510.562643][T11425] CPU: 0 UID: 0 PID: 11425 Comm: syz.1.1155 Not tainted syzkaller #0 PREEMPT(full) [ 510.562673][T11425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 510.562685][T11425] Call Trace: [ 510.562693][T11425] [ 510.562701][T11425] dump_stack_lvl+0xe8/0x150 [ 510.562732][T11425] should_fail_ex+0x412/0x560 [ 510.562759][T11425] should_failslab+0xa8/0x100 [ 510.562784][T11425] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 510.562815][T11425] ? __alloc_skb+0x1d0/0x7d0 [ 510.562836][T11425] ? __local_bh_enable_ip+0xd0/0x130 [ 510.562865][T11425] __alloc_skb+0x1d0/0x7d0 [ 510.562892][T11425] hci_cmd_sync_alloc+0x3d/0x3a0 [ 510.562914][T11425] ? __raw_spin_lock_init+0x45/0x100 [ 510.562927][T11425] __hci_cmd_sync_sk+0x1c8/0xcd0 [ 510.562951][T11425] ? __pfx___hci_cmd_sync_sk+0x10/0x10 [ 510.562986][T11425] ? __mutex_lock+0x319/0x1300 [ 510.563008][T11425] ? __lock_acquire+0x6b5/0x2cf0 [ 510.563040][T11425] hci_set_powered_sync+0x546/0x820 [ 510.563064][T11425] ? __pfx_hci_set_powered_sync+0x10/0x10 [ 510.563081][T11425] ? do_raw_spin_lock+0x12b/0x2f0 [ 510.563098][T11425] hci_dev_do_poweroff+0x2e/0xc0 [ 510.563112][T11425] hci_rfkill_set_block+0x15f/0x290 [ 510.563131][T11425] ? __pfx_hci_rfkill_set_block+0x10/0x10 [ 510.563153][T11425] rfkill_set_block+0x1d2/0x440 [ 510.563184][T11425] rfkill_fop_write+0x461/0x5a0 [ 510.563209][T11425] ? apparmor_file_permission+0x1f4/0x300 [ 510.563231][T11425] ? __pfx_rfkill_fop_write+0x10/0x10 [ 510.563247][T11425] ? security_file_permission+0x20/0x260 [ 510.563266][T11425] ? rw_verify_area+0x255/0x4d0 [ 510.563280][T11425] ? __pfx_rfkill_fop_write+0x10/0x10 [ 510.563309][T11425] vfs_write+0x29a/0xb90 [ 510.563336][T11425] ? __pfx_vfs_write+0x10/0x10 [ 510.563357][T11425] ? __fget_files+0x2a/0x420 [ 510.563380][T11425] ? __fget_files+0x2a/0x420 [ 510.563394][T11425] ? __fget_files+0x3a0/0x420 [ 510.563408][T11425] ? __fget_files+0x2a/0x420 [ 510.563429][T11425] ksys_write+0x150/0x270 [ 510.563449][T11425] ? __pfx_ksys_write+0x10/0x10 [ 510.563480][T11425] do_syscall_64+0x14d/0xf80 [ 510.563496][T11425] ? trace_irq_disable+0x3b/0x150 [ 510.563520][T11425] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.563535][T11425] ? clear_bhb_loop+0x40/0x90 [ 510.563549][T11425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.563560][T11425] RIP: 0033:0x7f9a5259c799 [ 510.563572][T11425] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.563582][T11425] RSP: 002b:00007f9a53524028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 510.563683][T11425] RAX: ffffffffffffffda RBX: 00007f9a52815fa0 RCX: 00007f9a5259c799 [ 510.563705][T11425] RDX: 0000000000000008 RSI: 0000200000000300 RDI: 0000000000000009 [ 510.563717][T11425] RBP: 00007f9a53524090 R08: 0000000000000000 R09: 0000000000000000 [ 510.563728][T11425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.563738][T11425] R13: 00007f9a52816038 R14: 00007f9a52815fa0 R15: 00007f9a5293fa48 [ 510.563934][T11425] [ 510.564035][T11425] Bluetooth: hci0: no memory for command (opcode 0x0c1a) [ 510.898332][T11425] Bluetooth: hci0: Opcode 0x0c1a failed: -12 [ 510.904915][ T5896] gp8psk: usb in 138 operation failed. [ 510.905140][T11440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.922506][ T5896] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 510.938289][ T5823] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 510.946797][T11425] Bluetooth: hci0: Error when powering off device on rfkill (-12) [ 510.960791][ T5896] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 511.008749][T11440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.117030][T11425] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 511.222622][T11425] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 511.231502][ T5823] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 511.270326][T11425] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 511.276387][ T5823] usb 3-1: config 0 has no interface number 0 [ 511.279691][T11425] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 511.295378][ T5823] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 511.324838][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.345186][ T5823] usb 3-1: Product: syz [ 511.350553][ T5823] usb 3-1: Manufacturer: syz [ 511.359033][ T5823] usb 3-1: SerialNumber: syz [ 511.417349][ T5823] usb 3-1: config 0 descriptor?? [ 511.437532][ T9] usb 4-1: USB disconnect, device number 44 [ 511.453068][T11425] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 511.481889][T11425] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 511.765509][ T5823] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 511.920858][ T5823] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 511.932207][ T5823] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 511.945319][ T5823] usb 3-1: media controller created [ 511.958022][ T5823] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 512.128269][ T5926] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 512.179272][ T5823] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 512.258429][ T5926] usb 2-1: device descriptor read/64, error -71 [ 512.258914][ T5823] usb 3-1: USB disconnect, device number 32 [ 512.265180][ T5921] usb 36-1: device descriptor read/8, error -110 [ 512.296269][T11466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1161'. [ 512.345284][T11468] FAULT_INJECTION: forcing a failure. [ 512.345284][T11468] name failslab, interval 1, probability 0, space 0, times 0 [ 512.375957][T11468] CPU: 0 UID: 0 PID: 11468 Comm: syz.3.1162 Not tainted syzkaller #0 PREEMPT(full) [ 512.375987][T11468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 512.375998][T11468] Call Trace: [ 512.376006][T11468] [ 512.376013][T11468] dump_stack_lvl+0xe8/0x150 [ 512.376050][T11468] should_fail_ex+0x412/0x560 [ 512.376079][T11468] should_failslab+0xa8/0x100 [ 512.376100][T11468] ? do_getname_kernel+0x54/0x230 [ 512.376124][T11468] kmem_cache_alloc_noprof+0x87/0x650 [ 512.376151][T11468] ? skb_set_owner_w+0x26c/0x3e0 [ 512.376186][T11468] do_getname_kernel+0x54/0x230 [ 512.376209][T11468] ? kern_path+0x1b/0x150 [ 512.376237][T11468] kern_path+0x25/0x150 [ 512.376266][T11468] unix_find_other+0x197/0xac0 [ 512.376296][T11468] ? __pfx_unix_find_other+0x10/0x10 [ 512.376319][T11468] ? skb_copy_datagram_from_iter+0x64b/0x710 [ 512.376341][T11468] ? get_pid+0x52/0x80 [ 512.376366][T11468] unix_dgram_sendmsg+0x76b/0x18e0 [ 512.376390][T11468] ? __pfx_tomoyo_check_unix_address+0x10/0x10 [ 512.376437][T11468] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 512.376457][T11468] ? tomoyo_socket_sendmsg_permission+0x1d9/0x300 [ 512.376491][T11468] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 512.376513][T11468] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 512.376533][T11468] ____sys_sendmsg+0xa68/0xad0 [ 512.376579][T11468] ? __pfx_____sys_sendmsg+0x10/0x10 [ 512.376616][T11468] ? import_iovec+0x73/0xa0 [ 512.376648][T11468] ___sys_sendmsg+0x2a5/0x360 [ 512.376679][T11468] ? __pfx____sys_sendmsg+0x10/0x10 [ 512.376746][T11468] __sys_sendmmsg+0x27c/0x4e0 [ 512.376766][T11468] ? __pfx___sys_sendmmsg+0x10/0x10 [ 512.376781][T11468] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 512.376807][T11468] ? ksys_write+0x242/0x270 [ 512.376821][T11468] ? __pfx_ksys_write+0x10/0x10 [ 512.376837][T11468] __x64_sys_sendmmsg+0xa0/0xc0 [ 512.376855][T11468] do_syscall_64+0x14d/0xf80 [ 512.376865][T11468] ? trace_irq_disable+0x3b/0x150 [ 512.376880][T11468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.376892][T11468] ? clear_bhb_loop+0x40/0x90 [ 512.376906][T11468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.376917][T11468] RIP: 0033:0x7fea5a19c799 [ 512.376930][T11468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.376939][T11468] RSP: 002b:00007fea5b074028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 512.376953][T11468] RAX: ffffffffffffffda RBX: 00007fea5a415fa0 RCX: 00007fea5a19c799 [ 512.376962][T11468] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: 0000000000000005 [ 512.376969][T11468] RBP: 00007fea5b074090 R08: 0000000000000000 R09: 0000000000000000 [ 512.376976][T11468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.376983][T11468] R13: 00007fea5a416038 R14: 00007fea5a415fa0 R15: 00007fea5a53fa48 [ 512.377000][T11468] [ 512.778337][ T5926] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 512.938235][ T5926] usb 2-1: device descriptor read/64, error -71 [ 512.989081][ T5921] usb usb36-port1: attempt power cycle [ 513.049283][ T5926] usb usb2-port1: attempt power cycle [ 513.438850][ T5926] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 513.459845][ T5926] usb 2-1: device descriptor read/8, error -71 [ 513.599008][ T5921] usb usb36-port1: unable to enumerate USB device [ 513.701531][ T5926] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 513.729250][ T5926] usb 2-1: device descriptor read/8, error -71 [ 513.751942][ T5896] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 513.841615][ T5926] usb usb2-port1: unable to enumerate USB device [ 513.948806][ T5896] usb 1-1: Using ep0 maxpacket: 8 [ 513.956462][ T5896] usb 1-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 513.988635][ T5896] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 514.017302][ T5896] usb 1-1: config 1 interface 1 has no altsetting 0 [ 514.358395][ T5896] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 514.388392][ T5896] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.406294][ T5896] usb 1-1: Product: syz [ 514.435043][ T5896] usb 1-1: Manufacturer: syz [ 514.444566][ T5896] usb 1-1: SerialNumber: syz [ 515.122123][ T5896] usb 1-1: USB disconnect, device number 53 [ 515.159522][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 515.489117][T11508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1173'. [ 515.695786][T11516] netlink: 'syz.3.1176': attribute type 1 has an invalid length. [ 515.748397][T11517] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1175'. [ 515.911294][ T5896] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 516.200622][ T5896] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 516.242902][ T5896] usb 1-1: config 0 has no interface number 0 [ 516.581602][ T5896] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 516.652079][ T5896] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.688294][ T5896] usb 1-1: Product: syz [ 516.692608][ T5896] usb 1-1: Manufacturer: syz [ 516.697214][ T5896] usb 1-1: SerialNumber: syz [ 516.739368][ T5896] usb 1-1: config 0 descriptor?? [ 516.972627][ T5896] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 517.019236][ T5896] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 517.048486][ T5896] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 517.089769][ T5896] usb 1-1: media controller created [ 517.159000][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 517.240904][ T5896] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 517.409659][ T5896] usb 1-1: USB disconnect, device number 54 [ 517.926790][T11533] FAULT_INJECTION: forcing a failure. [ 517.926790][T11533] name failslab, interval 1, probability 0, space 0, times 0 [ 518.113881][T11533] CPU: 0 UID: 0 PID: 11533 Comm: syz.0.1179 Not tainted syzkaller #0 PREEMPT(full) [ 518.113901][T11533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 518.113909][T11533] Call Trace: [ 518.113914][T11533] [ 518.113919][T11533] dump_stack_lvl+0xe8/0x150 [ 518.113942][T11533] should_fail_ex+0x412/0x560 [ 518.113959][T11533] should_failslab+0xa8/0x100 [ 518.113974][T11533] __kmalloc_cache_noprof+0x88/0x660 [ 518.113987][T11533] ? basic_change+0x2f9/0xfc0 [ 518.114003][T11533] basic_change+0x2f9/0xfc0 [ 518.114015][T11533] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 518.114033][T11533] ? __pfx_basic_change+0x10/0x10 [ 518.114056][T11533] tc_new_tfilter+0xe1c/0x1630 [ 518.114087][T11533] ? __pfx_tc_new_tfilter+0x10/0x10 [ 518.114120][T11533] ? __pfx_tc_new_tfilter+0x10/0x10 [ 518.114135][T11533] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 518.114153][T11533] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 518.114166][T11533] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 518.114179][T11533] ? ref_tracker_free+0x693/0x840 [ 518.114192][T11533] ? __copy_skb_header+0xa3/0x4a0 [ 518.114210][T11533] ? __pfx_ref_tracker_free+0x10/0x10 [ 518.114222][T11533] ? __skb_clone+0x63/0x7a0 [ 518.114243][T11533] netlink_rcv_skb+0x232/0x4b0 [ 518.114258][T11533] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 518.114272][T11533] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 518.114292][T11533] ? netlink_deliver_tap+0x2e/0x1b0 [ 518.114309][T11533] netlink_unicast+0x80f/0x9b0 [ 518.114326][T11533] ? __pfx_netlink_unicast+0x10/0x10 [ 518.114340][T11533] ? netlink_sendmsg+0x650/0xb40 [ 518.114352][T11533] ? skb_put+0x11b/0x210 [ 518.114368][T11533] netlink_sendmsg+0x813/0xb40 [ 518.114387][T11533] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.114403][T11533] ? aa_sock_msg_perm+0xf1/0x1b0 [ 518.114417][T11533] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 518.114431][T11533] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.114444][T11533] ____sys_sendmsg+0xa68/0xad0 [ 518.114465][T11533] ? __pfx_____sys_sendmsg+0x10/0x10 [ 518.114486][T11533] ? import_iovec+0x73/0xa0 [ 518.114504][T11533] ___sys_sendmsg+0x2a5/0x360 [ 518.114523][T11533] ? __pfx____sys_sendmsg+0x10/0x10 [ 518.114566][T11533] ? __fget_files+0x2a/0x420 [ 518.114582][T11533] ? __fget_files+0x3a0/0x420 [ 518.114602][T11533] __x64_sys_sendmsg+0x1bd/0x2a0 [ 518.114626][T11533] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 518.114648][T11533] ? __pfx_ksys_write+0x10/0x10 [ 518.114665][T11533] do_syscall_64+0x14d/0xf80 [ 518.114676][T11533] ? trace_irq_disable+0x3b/0x150 [ 518.114692][T11533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.114703][T11533] ? clear_bhb_loop+0x40/0x90 [ 518.114717][T11533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.114728][T11533] RIP: 0033:0x7f1b6c79c799 [ 518.114740][T11533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.114752][T11533] RSP: 002b:00007f1b6a9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.114773][T11533] RAX: ffffffffffffffda RBX: 00007f1b6ca15fa0 RCX: 00007f1b6c79c799 [ 518.114785][T11533] RDX: 0000000000008000 RSI: 00002000000001c0 RDI: 0000000000000007 [ 518.114796][T11533] RBP: 00007f1b6a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 518.114807][T11533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.114818][T11533] R13: 00007f1b6ca16038 R14: 00007f1b6ca15fa0 R15: 00007f1b6cb3fa48 [ 518.114846][T11533] [ 519.577433][T11544] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1181'. [ 520.529580][T11552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1185'. [ 521.005581][ T5926] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 521.239545][ T5926] usb 5-1: Using ep0 maxpacket: 8 [ 521.264362][ T5926] usb 5-1: config 1 has an invalid descriptor of length 111, skipping remainder of the config [ 521.300568][ T5926] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 225, setting to 64 [ 521.311785][ T5926] usb 5-1: config 1 interface 1 has no altsetting 0 [ 521.326803][ T5926] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 521.336898][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.345361][ T5926] usb 5-1: Product: syz [ 521.350051][ T5926] usb 5-1: Manufacturer: syz [ 521.354695][ T5926] usb 5-1: SerialNumber: syz [ 521.699283][ T9] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 522.211502][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 522.237356][ T9] usb 3-1: config 0 has an invalid interface number: 74 but max is 1 [ 522.256552][ T5926] usb 5-1: USB disconnect, device number 50 [ 522.270499][ T9] usb 3-1: config 0 has no interface number 1 [ 522.390884][ T9] usb 3-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=8e.fa [ 522.401642][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.415747][ T9] usb 3-1: Product: syz [ 522.420373][ T9] usb 3-1: Manufacturer: syz [ 522.450597][ T9] usb 3-1: SerialNumber: syz [ 522.498961][ T9] usb 3-1: config 0 descriptor?? [ 522.663293][ T9] snd-usb-audio 3-1:0.74: probe with driver snd-usb-audio failed with error -22 [ 522.696633][ T7213] udevd[7213]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.74/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 523.150673][T11516] net_ratelimit: 367 callbacks suppressed [ 523.150690][T11516] Set syz1 is full, maxelem 65536 reached [ 523.326329][T11583] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1193'. [ 523.346797][T11583] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1193'. [ 523.363392][T11583] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1193'. [ 523.373232][T11583] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.400012][T11583] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.548282][ T796] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 523.698296][ T796] usb 4-1: Using ep0 maxpacket: 16 [ 523.712496][ T796] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 523.721983][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.731106][ T796] usb 4-1: Product: syz [ 523.735354][ T796] usb 4-1: Manufacturer: syz [ 523.741954][ T796] usb 4-1: SerialNumber: syz [ 523.818264][ T5926] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 523.980966][ T5926] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 523.991592][ T796] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 524.050693][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.063166][ T5896] usb 3-1: USB disconnect, device number 33 [ 524.072907][ T796] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 524.089186][ T5926] usb 5-1: Product: syz [ 524.093421][ T5926] usb 5-1: Manufacturer: syz [ 524.131615][ T796] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 524.148632][ T5926] usb 5-1: SerialNumber: syz [ 524.156828][ T796] usb 4-1: media controller created [ 524.165780][ T5926] usb 5-1: config 0 descriptor?? [ 524.186342][ T5926] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 051 [ 524.223549][ T796] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 524.226938][T11592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1198'. [ 524.403156][ T796] zl10353_read_register: readreg error (reg=127, ret==-32) [ 524.555122][ T796] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 524.581779][ T796] usb 4-1: USB disconnect, device number 45 [ 524.623658][ T5926] (null): failure reading functionality [ 524.688092][ T5926] i2c i2c-2: connected i2c-tiny-usb device [ 524.734001][T11603] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1201'. [ 524.785215][T11605] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 524.995261][T11612] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1204'. [ 525.564702][T11622] netlink: 'syz.3.1207': attribute type 1 has an invalid length. [ 525.719746][ T5823] usb 5-1: USB disconnect, device number 51 [ 526.133066][T11623] Set syz1 is full, maxelem 65536 reached [ 526.594006][T11629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1210'. [ 526.699541][T11633] netlink: 'syz.1.1208': attribute type 1 has an invalid length. [ 527.258237][ T5882] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 527.452438][ T5926] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 527.498289][ T5882] usb 5-1: device descriptor read/64, error -71 [ 527.738314][ T5926] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 527.761320][ T5882] usb 5-1: new full-speed USB device number 53 using dummy_hcd [ 527.771835][ T5926] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 527.789799][ T5926] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 527.799368][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.841412][ T5926] usb 3-1: config 0 descriptor?? [ 527.947669][ T5882] usb 5-1: device descriptor read/64, error -71 [ 527.974184][T11646] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1214'. [ 528.058600][ T5882] usb usb5-port1: attempt power cycle [ 528.247367][T11648] netlink: 'syz.0.1215': attribute type 1 has an invalid length. [ 528.484466][ T5882] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 528.561493][ T5882] usb 5-1: device descriptor read/8, error -71 [ 528.680067][ T5926] ath6kl: Failed to submit usb control message: -71 [ 528.697031][ T5926] ath6kl: unable to send the bmi data to the device: -71 [ 528.713426][ T5926] ath6kl: Unable to send get target info: -71 [ 528.730839][ T5926] ath6kl: Failed to init ath6kl core: -71 [ 528.753493][ T5926] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 528.779366][T11651] syzkaller0: entered promiscuous mode [ 528.784968][T11651] syzkaller0: entered allmulticast mode [ 528.806033][ T5926] usb 3-1: USB disconnect, device number 34 [ 528.829297][T11651] tipc: Started in network mode [ 528.835226][T11651] tipc: Node identity 8ae269e07613, cluster identity 4711 [ 528.844616][T11651] tipc: Enabled bearer , priority 0 [ 528.856458][ T5882] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 529.001997][ T5882] usb 5-1: device descriptor read/8, error -71 [ 529.128531][ T5882] usb usb5-port1: unable to enumerate USB device [ 529.729452][ T5882] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 529.840306][ T796] tipc: Node number set to 4243679712 [ 529.970009][ T5882] usb 3-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 529.991618][ T5882] usb 3-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x51, changing to 0x1 [ 530.000029][T11655] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 530.033725][ T5882] usb 3-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 530.074804][T11657] ipvlan2: entered promiscuous mode [ 530.081208][T11657] ipvlan2: entered allmulticast mode [ 530.086566][T11657] hsr0: entered allmulticast mode [ 530.105236][T11657] hsr_slave_0: entered allmulticast mode [ 530.107949][ T5882] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 530.112014][T11657] hsr_slave_1: entered allmulticast mode [ 530.161273][ T5882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.171271][T11657] team0: Device ipvlan2 failed to register rx_handler [ 530.427232][ T5882] ath6kl: Failed to submit usb control message: -71 [ 530.450555][T11650] tipc: Resetting bearer [ 530.478205][ T5882] ath6kl: unable to send the bmi data to the device: -71 [ 530.514728][ T5882] ath6kl: Unable to send get target info: -71 [ 530.540308][ T5882] ath6kl: Failed to init ath6kl core: -71 [ 530.563739][ T5882] ath6kl_usb 3-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 530.615184][T11660] netlink: 'syz.4.1220': attribute type 1 has an invalid length. [ 530.624314][T11650] tipc: Disabling bearer [ 530.633328][ T5882] usb 3-1: USB disconnect, device number 35 [ 530.871050][ T9] usb 4-1: new low-speed USB device number 46 using dummy_hcd [ 531.040802][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 531.059878][ T9] usb 4-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 531.176336][T11668] fuse: Unknown parameter 'grou00000000000000000000' [ 531.279155][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 531.403195][ T9] usb 4-1: string descriptor 0 read error: -22 [ 531.418322][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 531.442527][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.466723][ T9] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input31 [ 531.949229][ T5177] bcm5974 4-1:1.0: could not read from device [ 531.961167][ T5177] bcm5974 4-1:1.0: could not read from device [ 532.018313][ T5926] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 532.088245][ T5177] bcm5974 4-1:1.0: could not read from device [ 532.095204][ T9] usb 4-1: USB disconnect, device number 46 [ 532.095518][ T5177] bcm5974 4-1:1.0: could not read from device [ 532.163057][ T5177] bcm5974 4-1:1.0: could not read from device [ 532.178408][ T5926] usb 3-1: device descriptor read/64, error -71 [ 532.419021][ T5926] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 532.558305][ T5926] usb 3-1: device descriptor read/64, error -71 [ 532.675187][ T5926] usb usb3-port1: attempt power cycle [ 532.846154][T11683] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1225'. [ 533.045658][T11686] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1226'. [ 533.108229][ T5926] usb 3-1: new full-speed USB device number 38 using dummy_hcd [ 533.140863][ T5926] usb 3-1: device descriptor read/8, error -71 [ 533.809240][ T5926] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 533.843896][ T5926] usb 3-1: device descriptor read/8, error -71 [ 533.958715][ T5926] usb usb3-port1: unable to enumerate USB device [ 534.047177][T11633] Set syz1 is full, maxelem 65536 reached [ 534.248279][ T5926] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 534.408226][ T5926] usb 1-1: Using ep0 maxpacket: 32 [ 534.409472][T11660] Set syz1 is full, maxelem 65536 reached [ 534.431793][ T5926] usb 1-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 534.453195][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.543525][ T5926] usb 1-1: Product: syz [ 534.571067][ T5926] usb 1-1: Manufacturer: syz [ 534.578268][ T5926] usb 1-1: SerialNumber: syz [ 534.595186][ T5926] usb 1-1: config 0 descriptor?? [ 534.619189][ T5926] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 534.645998][ T5926] dw2102: su3000_power_ctrl: 1, initialized 0 [ 534.660145][ T5926] dvb-usb: bulk message failed: -22 (2/0) [ 534.697086][ T5926] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 534.746395][ T5926] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 534.778322][ T5926] usb 1-1: media controller created [ 534.783701][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 534.833770][ T5926] dw2102: i2c transfer failed. [ 534.847370][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 534.870960][ T5926] dw2102: i2c transfer failed. [ 534.885870][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 534.892272][ T5926] dw2102: i2c transfer failed. [ 534.897564][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 535.618722][ T5926] dw2102: i2c transfer failed. [ 535.624617][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 535.629647][T11705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.671288][ T5926] dw2102: i2c transfer failed. [ 535.681363][ T5926] dvb-usb: bulk message failed: -22 (6/0) [ 535.684840][T11705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.711621][ T5926] dw2102: i2c transfer failed. [ 535.722901][ T5926] dvb-usb: MAC address: 02:02:02:02:02:02 [ 535.743257][T11707] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 535.807092][ T5926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 535.967418][ T5926] dvb-usb: bulk message failed: -22 (3/0) [ 535.983634][ T5926] dw2102: command 0x0e transfer failed. [ 536.000706][ T5926] dvb-usb: bulk message failed: -22 (3/0) [ 536.018260][ T5926] dw2102: command 0x0e transfer failed. [ 536.328270][ T5926] dvb-usb: bulk message failed: -22 (3/0) [ 536.341550][ T5926] dw2102: command 0x0e transfer failed. [ 536.357700][ T5926] dvb-usb: bulk message failed: -22 (3/0) [ 536.368917][ T5926] dw2102: command 0x0e transfer failed. [ 536.374527][ T5926] dvb-usb: bulk message failed: -22 (1/0) [ 536.393545][ T5926] dw2102: command 0x51 transfer failed. [ 536.408252][T11594] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 536.482756][ T5926] DVB: Unable to find symbol ds3000_attach() [ 536.516893][ T5926] dvb-usb: no frontend was attached by 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' [ 536.611367][T11594] usb 2-1: unable to get BOS descriptor or descriptor too short [ 536.640465][T11594] usb 2-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 536.714557][T11594] usb 2-1: config 1 interface 0 has no altsetting 0 [ 536.740781][ T5926] rc_core: IR keymap rc-su3000 not found [ 536.769690][T11594] usb 2-1: string descriptor 0 read error: -22 [ 536.807869][ T5926] Registered IR keymap rc-empty [ 536.817933][T11594] usb 2-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 536.839435][ T5926] rc rc0: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 536.869946][T11594] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.919529][ T5926] input: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input32 [ 536.956382][T11594] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input33 [ 536.984193][ T5926] dvb-usb: schedule remote query interval to 150 msecs. [ 537.010694][ T5926] dw2102: su3000_power_ctrl: 0, initialized 1 [ 537.024068][ T5926] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 successfully initialized and connected. [ 537.100216][ T5926] usb 1-1: USB disconnect, device number 55 [ 537.358638][T11743] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1239'. [ 537.562057][ T5177] bcm5974 2-1:1.0: could not read from device [ 537.596783][ T5177] bcm5974 2-1:1.0: could not read from device [ 537.813790][T11594] usb 2-1: USB disconnect, device number 41 [ 537.834694][ T5177] bcm5974 2-1:1.0: could not read from device [ 537.881603][ T7213] bcm5974 2-1:1.0: could not read from device [ 537.969780][ T5926] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2. successfully deinitialized and disconnected. [ 537.994399][ T5177] bcm5974 2-1:1.0: could not read from device [ 539.042283][T11762] Cannot find del_set index 2 as target [ 539.213207][T11766] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 539.220031][T11766] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 539.293967][T11766] vhci_hcd vhci_hcd.0: Device attached [ 539.523138][T11767] vhci_hcd: connection closed [ 539.523550][ T1326] vhci_hcd vhci_hcd.2: stop threads [ 539.533631][ T1326] vhci_hcd vhci_hcd.2: release socket [ 539.548295][ T5926] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 539.568298][ T1326] vhci_hcd vhci_hcd.2: disconnect device [ 541.115805][T11789] fuse: Unknown parameter 'grou00000000000000000000' [ 542.818701][ T5896] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 542.910333][ T796] usb 4-1: new low-speed USB device number 47 using dummy_hcd [ 542.984738][ T5896] usb 5-1: unable to get BOS descriptor or descriptor too short [ 543.025254][ T5896] usb 5-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 543.054368][ T5896] usb 5-1: config 1 interface 0 has no altsetting 0 [ 543.101254][ T5896] usb 5-1: string descriptor 0 read error: -22 [ 543.108426][ T5896] usb 5-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 543.119308][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.212040][ T5896] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input34 [ 543.431116][T11797] erspan1: entered promiscuous mode [ 543.446837][T11797] erspan1: entered allmulticast mode [ 543.750978][ T5177] bcm5974 5-1:1.0: could not read from device [ 543.780919][ T5177] bcm5974 5-1:1.0: could not read from device [ 543.789364][ T5896] usb 5-1: USB disconnect, device number 56 [ 543.819049][ T5177] bcm5974 5-1:1.0: could not read from device [ 543.848602][ T5177] bcm5974 5-1:1.0: could not read from device [ 544.119028][T11812] Set syz1 is full, maxelem 65536 reached [ 544.647801][T11834] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1255'. [ 544.683280][ T5926] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 544.703525][T11836] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1254'. [ 545.792489][ T796] usb 4-1: unable to get BOS descriptor or descriptor too short [ 545.909482][ T796] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 545.961560][ T796] usb 4-1: can't read configurations, error -71 [ 547.006372][T11853] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1259'. [ 547.265543][T11858] netlink: 212360 bytes leftover after parsing attributes in process `syz.3.1261'. [ 550.074379][T11898] ip6tnl0: Caught tx_queue_len zero misconfig [ 551.532116][ T30] audit: type=1400 audit(1772318805.628:378): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=11913 comm="syz.3.1272" [ 552.758917][T11927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1276'. [ 554.122660][T11939] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1278'. [ 554.918034][T11941] netlink: zone id is out of range [ 554.963410][T11941] netlink: zone id is out of range [ 554.969044][T11941] netlink: zone id is out of range [ 554.975065][T11941] netlink: zone id is out of range [ 554.993728][T11941] netlink: zone id is out of range [ 555.003210][T11941] netlink: zone id is out of range [ 555.008502][T11941] netlink: zone id is out of range [ 555.028235][T11941] netlink: zone id is out of range [ 555.033454][T11941] netlink: zone id is out of range [ 555.038938][T11941] netlink: zone id is out of range [ 556.292220][T11969] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1281'. [ 556.858242][ T9] usb 4-1: new low-speed USB device number 49 using dummy_hcd [ 557.117737][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 557.184810][ T9] usb 4-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 557.219480][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 557.994794][ T9] usb 4-1: string descriptor 0 read error: -22 [ 558.176738][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 558.265340][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.432969][ T9] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input35 [ 558.761902][ T5177] bcm5974 4-1:1.0: could not read from device [ 558.969583][ T5940] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 559.039312][ T5177] bcm5974 4-1:1.0: could not read from device [ 559.128466][ T5940] usb 2-1: Using ep0 maxpacket: 16 [ 559.270900][ T5177] bcm5974 4-1:1.0: could not read from device [ 559.272276][ T5940] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 559.288546][ T5940] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.320414][ T9] usb 4-1: USB disconnect, device number 49 [ 559.335651][ T5940] usb 2-1: Product: syz [ 559.353293][ T5940] usb 2-1: Manufacturer: syz [ 559.379124][ T5940] usb 2-1: SerialNumber: syz [ 559.438792][ T7213] bcm5974 4-1:1.0: could not read from device [ 559.506506][ T5177] bcm5974 4-1:1.0: could not read from device [ 559.716619][ T5940] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 560.347405][ T5940] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 560.394490][ T5940] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 560.406204][ T5940] usb 2-1: media controller created [ 560.510858][ T5940] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 560.528541][ T5940] zl10353_read_register: readreg error (reg=127, ret==-71) [ 560.622333][ T5940] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 560.707831][ T5940] usb 2-1: USB disconnect, device number 42 [ 561.267334][T12013] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.1292'. [ 562.105209][T12023] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1294'. [ 563.139950][ C1] net_ratelimit: 178 callbacks suppressed [ 563.139973][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 563.147579][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.165907][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.227625][T12035] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 563.898270][ T5926] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 564.318514][ T5940] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 564.327287][ T5926] usb 2-1: Using ep0 maxpacket: 16 [ 564.350142][ T5926] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 564.378547][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.399981][ T5926] usb 2-1: Product: syz [ 564.404181][ T5926] usb 2-1: Manufacturer: syz [ 564.420226][ T5926] usb 2-1: SerialNumber: syz [ 564.468361][ T5940] usb 1-1: Using ep0 maxpacket: 32 [ 564.491777][ T5940] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 564.510114][ T5940] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.560511][ T5940] usb 1-1: config 0 descriptor?? [ 564.586059][ T5823] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 564.654103][ T5926] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 564.682754][ T5926] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 564.694263][ T5926] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 564.714339][ T5926] usb 2-1: media controller created [ 564.745272][ T5926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 564.780332][ T5940] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 564.801299][ T5823] usb 3-1: Using ep0 maxpacket: 8 [ 564.822648][ T5940] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 564.839675][ T5823] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 564.851682][ T5823] usb 3-1: config 0 has no interface number 0 [ 564.859412][ T5823] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 564.878141][ T5940] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 564.888850][ T5940] usb 1-1: media controller created [ 564.896615][ T5823] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 564.905341][T12054] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1304'. [ 564.927827][ T5823] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 564.942017][ T5940] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 564.952094][ T5823] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 564.992704][ T5823] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 565.006214][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.016531][ T5823] usb 3-1: Product: syz [ 565.021300][ T5823] usb 3-1: Manufacturer: syz [ 565.025967][ T5823] usb 3-1: SerialNumber: syz [ 565.041180][ T5823] usb 3-1: config 0 descriptor?? [ 565.075404][ T5926] zl10353_read_register: readreg error (reg=127, ret==-71) [ 565.075485][T12047] ------------[ cut here ]------------ [ 565.088822][T12047] usb 2-1: BOGUS control dir, pipe 80002b80 doesn't match bRequestType c0 [ 565.097501][T12047] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1052/0x18b0, CPU#0: syz.0.1301/12047 [ 565.108248][T12047] Modules linked in: [ 565.114474][T12047] CPU: 0 UID: 0 PID: 12047 Comm: syz.0.1301 Not tainted syzkaller #0 PREEMPT(full) [ 565.124890][T12047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 565.135369][T12047] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 565.141825][T12047] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 565.162055][T12047] RSP: 0018:ffffc900035f7708 EFLAGS: 00010246 [ 565.168249][T12047] RAX: 0000000000000000 RBX: ffff888033502400 RCX: 0000000080002b80 [ 565.176307][T12047] RDX: ffff888029dc2fc0 RSI: ffffffff8c7ef100 RDI: ffffffff901ebfb0 [ 565.184407][T12047] RBP: 1ffff1100da0ec4c R08: 00000000000000c0 R09: 0000000000000000 [ 565.193179][T12047] R10: ffffc900035f7800 R11: fffff520006bef0c R12: ffff88801f3af100 [ 565.201274][T12047] R13: ffff88806d076260 R14: 0000000080002b80 R15: ffff888029dc2fc0 [ 565.209498][T12047] FS: 00007f1b6a9f66c0(0000) GS:ffff888125464000(0000) knlGS:0000000000000000 [ 565.220479][T12047] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 565.227111][T12047] CR2: 0000200000011030 CR3: 000000007dca8000 CR4: 00000000003526f0 [ 565.236402][T12047] Call Trace: [ 565.239787][T12047] [ 565.242863][T12047] ? __init_swait_queue_head+0xa9/0x150 [ 565.248789][T12047] usb_start_wait_urb+0x12b/0x510 [ 565.253976][T12047] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 565.259595][T12047] usb_control_msg+0x232/0x3e0 [ 565.264852][T12047] gl861_ctrl_msg+0x207/0x420 [ 565.269778][T12047] ? lockdep_hardirqs_on+0x7a/0x110 [ 565.275016][T12047] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 565.280310][T12047] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 565.285542][T12047] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 565.291064][T12047] ? aa_file_perm+0x50e/0x15e0 [ 565.296053][T12047] gl861_i2c_master_xfer+0x439/0x6a0 [ 565.301526][T12047] __i2c_transfer+0x79a/0x2020 [ 565.306328][T12047] ? i2c_transfer+0xc8/0x2d0 [ 565.311075][T12047] i2c_transfer+0x1cc/0x2d0 [ 565.315678][T12047] i2c_transfer_buffer_flags+0x10d/0x1a0 [ 565.322340][T12047] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 565.329201][T12047] ? i2cdev_read+0xe8/0x250 [ 565.333744][T12047] i2cdev_read+0x10d/0x250 [ 565.338237][T12047] ? __pfx_i2cdev_read+0x10/0x10 [ 565.343249][T12047] vfs_read+0x20c/0xa70 [ 565.347543][T12047] ? __pfx_vfs_read+0x10/0x10 [ 565.352345][T12047] ? __fget_files+0x2a/0x420 [ 565.356980][T12047] ? __fget_files+0x2a/0x420 [ 565.361653][T12047] ? __fget_files+0x3a0/0x420 [ 565.366393][T12047] ? __fget_files+0x2a/0x420 [ 565.371269][T12047] ksys_read+0x150/0x270 [ 565.375572][T12047] ? __pfx_ksys_read+0x10/0x10 [ 565.380389][T12047] do_syscall_64+0x14d/0xf80 [ 565.385088][T12047] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.391320][T12047] ? clear_bhb_loop+0x40/0x90 [ 565.396039][T12047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.402056][T12047] RIP: 0033:0x7f1b6c79c799 [ 565.406586][T12047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.429169][T12047] RSP: 002b:00007f1b6a9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 565.437697][T12047] RAX: ffffffffffffffda RBX: 00007f1b6ca15fa0 RCX: 00007f1b6c79c799 [ 565.446554][T12047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000a [ 565.454777][T12047] RBP: 00007f1b6c832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 565.463030][T12047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 565.471095][T12047] R13: 00007f1b6ca16038 R14: 00007f1b6ca15fa0 R15: 00007f1b6cb3fa48 [ 565.479308][T12047] [ 565.482439][T12047] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 565.489717][T12047] CPU: 0 UID: 0 PID: 12047 Comm: syz.0.1301 Not tainted syzkaller #0 PREEMPT(full) [ 565.499249][T12047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 565.509303][T12047] Call Trace: [ 565.512582][T12047] [ 565.515534][T12047] vpanic+0x56c/0xa60 [ 565.519541][T12047] ? __pfx__printk+0x10/0x10 [ 565.524261][T12047] ? __pfx_vpanic+0x10/0x10 [ 565.528765][T12047] ? is_bpf_text_address+0x292/0x2b0 [ 565.534130][T12047] ? is_bpf_text_address+0x26/0x2b0 [ 565.539335][T12047] panic+0xc5/0xd0 [ 565.543268][T12047] ? __pfx_panic+0x10/0x10 [ 565.547715][T12047] __warn+0x315/0x4f0 [ 565.551997][T12047] ? usb_submit_urb+0x1052/0x18b0 [ 565.557045][T12047] ? usb_submit_urb+0x1052/0x18b0 [ 565.562284][T12047] __report_bug+0x29a/0x540 [ 565.566899][T12047] ? usb_submit_urb+0x1052/0x18b0 [ 565.571963][T12047] ? __pfx___report_bug+0x10/0x10 [ 565.577029][T12047] ? lockdep_hardirqs_on+0x7a/0x110 [ 565.582268][T12047] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 565.588124][T12047] report_bug_entry+0x19a/0x290 [ 565.593033][T12047] ? usb_submit_urb+0x1114/0x18b0 [ 565.598147][T12047] ? usb_submit_urb+0x1119/0x18b0 [ 565.603232][T12047] handle_bug+0xca/0x200 [ 565.607476][T12047] exc_invalid_op+0x1a/0x50 [ 565.612168][T12047] asm_exc_invalid_op+0x1a/0x20 [ 565.617017][T12047] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 565.622665][T12047] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 565.642973][T12047] RSP: 0018:ffffc900035f7708 EFLAGS: 00010246 [ 565.649767][T12047] RAX: 0000000000000000 RBX: ffff888033502400 RCX: 0000000080002b80 [ 565.657938][T12047] RDX: ffff888029dc2fc0 RSI: ffffffff8c7ef100 RDI: ffffffff901ebfb0 [ 565.665932][T12047] RBP: 1ffff1100da0ec4c R08: 00000000000000c0 R09: 0000000000000000 [ 565.674449][T12047] R10: ffffc900035f7800 R11: fffff520006bef0c R12: ffff88801f3af100 [ 565.682513][T12047] R13: ffff88806d076260 R14: 0000000080002b80 R15: ffff888029dc2fc0 [ 565.690512][T12047] ? usb_submit_urb+0x10a3/0x18b0 [ 565.695657][T12047] ? __init_swait_queue_head+0xa9/0x150 [ 565.701275][T12047] usb_start_wait_urb+0x12b/0x510 [ 565.706325][T12047] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 565.711909][T12047] usb_control_msg+0x232/0x3e0 [ 565.716712][T12047] gl861_ctrl_msg+0x207/0x420 [ 565.721426][T12047] ? lockdep_hardirqs_on+0x7a/0x110 [ 565.726670][T12047] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 565.731934][T12047] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 565.737075][T12047] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 565.742570][T12047] ? aa_file_perm+0x50e/0x15e0 [ 565.747535][T12047] gl861_i2c_master_xfer+0x439/0x6a0 [ 565.753001][T12047] __i2c_transfer+0x79a/0x2020 [ 565.757854][T12047] ? i2c_transfer+0xc8/0x2d0 [ 565.762454][T12047] i2c_transfer+0x1cc/0x2d0 [ 565.767069][T12047] i2c_transfer_buffer_flags+0x10d/0x1a0 [ 565.772786][T12047] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 565.779060][T12047] ? i2cdev_read+0xe8/0x250 [ 565.783592][T12047] i2cdev_read+0x10d/0x250 [ 565.788292][T12047] ? __pfx_i2cdev_read+0x10/0x10 [ 565.793235][T12047] vfs_read+0x20c/0xa70 [ 565.797408][T12047] ? __pfx_vfs_read+0x10/0x10 [ 565.802128][T12047] ? __fget_files+0x2a/0x420 [ 565.806886][T12047] ? __fget_files+0x2a/0x420 [ 565.811510][T12047] ? __fget_files+0x3a0/0x420 [ 565.816231][T12047] ? __fget_files+0x2a/0x420 [ 565.820932][T12047] ksys_read+0x150/0x270 [ 565.825540][T12047] ? __pfx_ksys_read+0x10/0x10 [ 565.830350][T12047] do_syscall_64+0x14d/0xf80 [ 565.835136][T12047] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.841237][T12047] ? clear_bhb_loop+0x40/0x90 [ 565.846007][T12047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.851906][T12047] RIP: 0033:0x7f1b6c79c799 [ 565.856350][T12047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.876317][T12047] RSP: 002b:00007f1b6a9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 565.884757][T12047] RAX: ffffffffffffffda RBX: 00007f1b6ca15fa0 RCX: 00007f1b6c79c799 [ 565.892931][T12047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000a [ 565.901280][T12047] RBP: 00007f1b6c832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 565.909290][T12047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 565.917272][T12047] R13: 00007f1b6ca16038 R14: 00007f1b6ca15fa0 R15: 00007f1b6cb3fa48 [ 565.925355][T12047] [ 565.928560][T12047] Kernel Offset: disabled [ 565.932886][T12047] Rebooting in 86400 seconds..