last executing test programs:

15.402522827s ago: executing program 4 (id=3105):
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x5, 0x40, 0x6, 0x8}, 0x48)
unshare(0x20000400)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r1}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r2, 0x6}, 0x50)
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
lseek(r3, 0x4, 0x4)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xa0000, 0x0)
mknodat(r3, &(0x7f00000001c0)='./file0\x00', 0x4, 0x370)
ioctl$XFS_IOC_PATH_TO_FSHANDLE(r4, 0xc0385868, &(0x7f0000000540)={<r5=>r0, &(0x7f0000000440)=']}))\\\x00', 0x420640, &(0x7f0000000480)={@align=0x8001, {0x6, 0x4, 0x5, 0xdf4}}, 0xd6b, &(0x7f00000004c0), &(0x7f0000000500)=0x3})
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001b80)={r5}, 0x4)
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001e00)={0x7, <r6=>0x0}, 0x8)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x11, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000008000000000000000fdffffff850000007b000000b7080000000000007b8af8ff00000000b7080000161300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018030000", @ANYRES32], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@fallback=r7, r7, 0x2f, 0x8, 0x0, @void, @value=r7}, 0x20)

15.148532807s ago: executing program 4 (id=3107):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002})
r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
socket$inet6_mptcp(0xa, 0x1, 0x106)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
getpid()
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000008c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = dup3(r1, r0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f0000007fc0)={0x2020}, 0x2020)

14.298213257s ago: executing program 1 (id=3109):
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x7, 0x12, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
accept(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x4, &(0x7f0000001440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x6b}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x59, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94)
write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1)
sendmsg$IPSET_CMD_SAVE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000080601010000000000000000000000090500018007"], 0x28}, 0x1, 0x0, 0x0, 0x40080d0}, 0x40040)
syz_emit_ethernet(0x0, 0x0, 0x0)
syz_usb_connect(0x4, 0x24, 0x0, 0x0)
syz_usb_connect(0x1, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902440001000000000904000003ff01690005"], 0x0)
r1 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0)
ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000380)={0x1, @pix={0x500, 0x2, 0x3234564e, 0x7, 0xfffffffe, 0x0, 0x9, 0x7eedcafe, 0x3, 0x1, 0x2, 0x1}}) (fail_nth: 1)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079104800000000006104000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94)

11.913851926s ago: executing program 4 (id=3115):
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff9909080598b2"], 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003080)=ANY=[@ANYBLOB="5c0800002c0007012bbd700000000000057c00000c", @ANYBLOB="2d0529800c00f800030000000000000004006080fa003b800400df00c1becb03dbe55b6c782cebd6a7bc78a21d1bc9f3c1bd441ada5266780599eaf18965bbfcc07c2037129672275c399e1e03f8a0664d807385cc4d566f230400db800400498096d9641e8b1887b25501b11ecd71313a47df368b078d7b825bff33b9eab3964d7b2394b1950c7aeaba6014fe2cd33c89fd070ce0f1f306494a44adf6609d8ad55a5080b36b05cb0b9a57833b14fcd62c0aba0ac67f03b20e87ba6f3610a5bd1d3369ae014c8036c1e596b800991698810ff706e98871c17ad581b0695476273ac6c33a7a51d4a44a5b95684befe95ef49b03458bce89d87355f35b766b242b9f98b661269bb9255d836fb4e30d0000c72ec5561adf6112ca278273b4af42597e7bfa1f5c228f13161b34517c92bc352c017afac22d14047e6fbdc61536f9e51738ea935cb2a577ec2b788433bc13a9e976cfee267f36d988b766a29632c84c94d4cf31d780ef683293d7eacfc93f248d137affcae7cffa699237ea9c74919850dc164f1483f3f352bf7dd787191705b26936e1d090526b6ac5765df318f160cc84b15b94c662cf9261", @ANYBLOB="040044800800c800e00000027a01f380a2b4c1dbd4f221c0a1fd468ca63ae97de147e5bc2d0313377dc17591b491acf18312bee324decf810970090c77ec4ca173b12577aeb13c354245be77050365697b3b4707060c00045e46d612b09c487d7c9c94f778c0a015ecfa70d229085252956142772f9ff5a61a9b7fbc6712f8e64566b7ade87d293b81bd3cd1b2ad2852dc1dbb07d54f5544759f0eb23131b5780de6354f0714b2c5b86323969d0b4f5bd8c4489e0e7471c6a84feb9dead9d156d060a9373c7f80f4f1ec2a87efdeceec8d99c9664ee184f112929fe92da18f26929f98233f18dcbe0c638c040061800400058012fc33716331943112df1a6d89852782e376609e4a38717148d34e9d36191fe607748ad822c89800b204bd5831c55511fc4e85d09c44ef3be8ce710d034d394057d88e12db87eb032cd30fdcb489cd5ac92a44f96b6e463971c730796efaab04ce1b42faea757fc0a50c4feef468c80d7cac7db3bfd67140c04f88892b1d19a91ac5", @ANYRESOCT=r0, @ANYRESDEC=r0], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0x4000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
mremap(&(0x7f00000d5000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000ffd000/0x2000)=nil)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000280)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6c0000000001010400000000141a00000200000b240001801400018008000100e000000108000200e00000010c00280b381686a35f0000002c00028014000180080001000000000008000200ac1e00010c000280050001000000000006000340000100000800074000000001"], 0x6c}}, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000003010104000000000000000002000200240001801400018008000100e000000108000200e00000010c0002800500010000000000"], 0x38}}, 0x0)

11.772844437s ago: executing program 2 (id=3116):
r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
fchdir(r1)
r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40)
write(r4, &(0x7f0000004200)='t', 0x1)
sendfile(r4, r3, 0x0, 0x7fffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x3ffffffe, 0x0, 0x0, 0x0, 0x2}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}, @generic={0xc6, 0x8, 0x0, 0x0, 0xd}, @initr0, @exit, @exit]}, &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94)
ftruncate(r2, 0x2007ffb)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f00000002c0)={0x2, 0xc22, @remote}, 0x10)
getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f0000000040))
r6 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000e70000/0x3000)=nil, &(0x7f0000400000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000823000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000d13000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r7 = io_uring_setup(0x47, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xb, 0x338})
r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff)
ioctl$FICLONE(r8, 0x40049409, r8)
io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0)
bind$inet(r6, &(0x7f0000000340)={0x2, 0x4e23, @loopback}, 0x10)
sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x1a000}}, 0x0)
sendmsg$rds(r6, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendfile(r2, r2, 0x0, 0x1000000201005)

11.423895514s ago: executing program 1 (id=3117):
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x5, 0x40, 0x6, 0x8}, 0x48)
unshare(0x20000400)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r1}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r2, 0x6}, 0x50)
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
lseek(r3, 0x4, 0x4)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xa0000, 0x0)
mknodat(r3, &(0x7f00000001c0)='./file0\x00', 0x4, 0x370)
ioctl$XFS_IOC_PATH_TO_FSHANDLE(r4, 0xc0385868, &(0x7f0000000540)={<r5=>r0, &(0x7f0000000440)=']}))\\\x00', 0x420640, &(0x7f0000000480)={@align=0x8001, {0x6, 0x4, 0x5, 0xdf4}}, 0xd6b, &(0x7f00000004c0), &(0x7f0000000500)=0x3})
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001b80)={r5}, 0x4)
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001e00)={0x7, <r6=>0x0}, 0x8)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x11, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000008000000000000000fdffffff850000007b000000b7080000000000007b8af8ff00000000b7080000161300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018030000", @ANYRES32], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@fallback=r7, r7, 0x2f, 0x8, 0x0, @void, @value=r7}, 0x20)

9.648971954s ago: executing program 0 (id=3118):
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[], [{@smackfstransmute={'smackfstransmute', 0x3d, '*\\*)&:{'}}], 0x2c})
r0 = socket(0x40000000015, 0x5, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
unshare(0x28000600)
r1 = socket$xdp(0x2c, 0x3, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0)
r3 = socket$inet_icmp(0x2, 0x2, 0x1)
setsockopt$inet_int(r3, 0x0, 0x12, &(0x7f0000000080)=0x5, 0x4)
sendmmsg$inet(r3, &(0x7f0000000100)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)="080000009c000000", 0x8}], 0x1}}], 0x1, 0x4800)
recvmsg(r3, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x10020)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x3)
ioctl$TCSETA(r2, 0x5406, 0x0)
getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, 0xffffffffffffffff, &(0x7f0000000080)=0x20)
setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x1d, &(0x7f0000000080), 0x4)
r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000600)={'ip6tnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x0, 0xfd, 0x6, 0x0, 0x39, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @remote, 0x40, 0x7, 0x2, 0x35}})
sendmsg$sock(r5, &(0x7f0000000480)={&(0x7f0000000080)=@tipc=@name={0x1e, 0x2, 0x1, {{0x42, 0x2}, 0x3}}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000100)}, {&(0x7f0000000180)="79dd206c00305fa14496db2da12263170398e179810deed7856a96d4fd5fdeaff2386365192a0c638e9111318395fca8b4630728189d3dcf569aba401ff4429e8c7982f11bf25794cea7e73ee428a9ed0f00484e8b22f1d0c7c18e4d738293d46833244fbe73452613e21c7b50c19228914c6dc1da2bf75b96", 0x79}, {&(0x7f0000000300)="6043a9982ad166a240015aa32c0ce9f505cd100efce2c13c46e5b1909c5ced05089c8fb3c0723e4dc735b721eb31ac5c42433fea6590b93f6ed605546d96cd2fa08469995b5533a7cb77a5506b1e704a31da01d923b0bd7132e6a9240fd70a2faa6bd943f3f0d9abed4a087a755516951910630cefc95f6b0c99d94645a3a6d64f88bb05626508e29eddbd3bc474e2419008f6069841d73a9c3935b8c1fdf5e846c97091720a7983a3ddded5848e4c4c4ef60efbaebb5a55a33837e6a7403f79892d2fc5aa469ef9d014a0f2b7ee0f5ff36888a55690d42ccc89dbe7092df7e80f1458488e8940f949cd7c1fb9cbed", 0xef}], 0x3, &(0x7f0000000440)=[@mark={{0x14, 0x1, 0x24, 0x9}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}], 0x30}, 0x4)
r6 = syz_open_dev$ublk_bdev(&(0x7f0000000200), 0x0, 0x80c42)
r7 = socket(0xa, 0x1, 0x0)
setresuid(0xee00, 0xee00, 0x0)
fremovexattr(r7, &(0x7f0000000080)=@known='trusted.overlay.upper\x00')
write$ublk_bdev(r6, &(0x7f00000004c0)="f5d6cf9cd7e4757b866e6897c7f417e86fdd2b62f67f2c7a28583db914ac81a36a6aa6eaa3e00f9662b09b53f539b5fce63dd9aa37748f330d7cace49f3abd250cf221a2c3a4cd409f66d5c47f7ad1d23a358824d0166140c56f30bd75e1b8fc54fbdeb1251475651600294975d3889861d0ef4d3d2c3ff9f116924d76", 0x7d)
r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00"/14], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r4]}, 0x94)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000005c0), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_SET_FLAGS(r9, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x28, r10, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x48000)
sendmsg$MPTCP_PM_CMD_REMOVE(r7, &(0x7f0000000940)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000800)=ANY=[@ANYBLOB="cc50a4d4", @ANYRES16=r10, @ANYBLOB="000226bd7000fcdbdf25090000000800040001000000380001800800060011000000050002000600000014000400fe8000000000000000000000000000bb0500020001000000080006001000000024000180080006000600000006000100020000000500020005000000080003000a010100050005000300000005000500fd000000080003000400000034000180050002000100000014000400fc01000000000000000000000000000114000400fe8800000000000000000000000000010800030005000000"], 0xcc}, 0x1, 0x0, 0x0, 0x4004}, 0x800)

9.329074357s ago: executing program 1 (id=3119):
r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x2, 0x212140)
ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f0000000040)={0x1, 0x0, {0x2, 0x2, 0x201c, 0x4, 0x9, 0x8}})
r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x12)
setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000140)={0x3, &(0x7f0000000100)=[{0xc0, 0x0, 0x7, 0x80}, {0x7, 0x3, 0x4, 0x5}, {0xffff, 0x2, 0x2, 0x7}]}, 0x10)
ioctl$EXT4_IOC_MIGRATE(r1, 0x6609)
write$binfmt_script(r1, &(0x7f0000000180)={'#! ', './file0', [{0x20, '.\''}, {0x20, '/dev/v4l-subdev#\x00'}], 0xa, "169eb0aa058e9866083beaa6641c5168508c4888388c5e212f46b253243cf5ba9903c9"}, 0x43)
ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000200))
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000280), 0x106, 0x1}}, 0x20)
ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f0000000300)=0xffffffffffffffa6)
sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, 0x140b, 0x400, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x48081)
r4 = socket$tipc(0x1e, 0x2, 0x0)
ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000440)=<r5=>0x0)
ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000480)={{r4}, r5, 0x2, @unused=[0x5, 0x7fffffffffffffff, 0x21d33fd4, 0x1], @subvolid=0x8})
sendmsg$tipc(r1, &(0x7f00000019c0)={&(0x7f0000001480)=@name={0x1e, 0x2, 0x3, {{0x41, 0x2}}}, 0x10, &(0x7f0000001880)=[{&(0x7f00000014c0)="6ad943fe8b888d1a45afb781217043db095c0bd17222ead0863073f66db821026458cc576efd5f6a7538ce8c4ecb2cf3e7067d9bd3a97823ef06ec82420d81d3b160fbf4f77531816d289f2f00fd25ca6a28fc06e8aaaeb810a487de9a8ea29d461671c6f5436079848fc63f4b52e9f170e202cf7dec844560", 0x79}, {&(0x7f0000001540)="547f7c4f4780df06267f4bd064c7905c28a55400af683f1f91273a5ad9d89a82e666f4af990d7bc8d3c63b8436209cd78ca5dd533d852c1f6ecd5866e6d152269c8a7b42756320f55d17aa9879794ce9a5c7fb246b34c3d5106be99ecc03974eeb0df9140b8381a82a0ab2be6b7ff8a5643755a6725f13719ede05f12c802e35b5c6ce9302b3d8fbda98e7faa6fbed4f377915bd0aeb96566bdb9d8a6a97c1bb9ef0d913fc8af28f92d8674de8d50dbc2c90cfbfb20e5d5befd5059a551b9cebdeb71cb83b6f3f09faf4d8bfd5422a29", 0xd0}, {&(0x7f0000001640)="849d6e866c5788cdcc768d7525931a9ed2de1bfbd2f5d8cfd36954671276109caafcc00fb9b30d8fd602687b421d1439fd5dfce9080c86a0d83f8b040bf17cc75a0486cc6b5af0f013f52c5a33400f63df81eb3bb5795b4e0ed0a072ccf8dea476f49e5724cfba0c028ce56ff9c55e23c9789624cbc4485b7e12c6f46672cc9513e94e344abd4abaf4f773ebc2a4a043fad74fd826515330d172ddd1a586793384365918b39c", 0xa6}, {&(0x7f0000001700)="9003227b2f29fccc50ca2a62889222935d1911dd6df2788287faebb3d5d61df1edd69672b33c6f5de35fc0c0e02620e46433236d4b3741128b6444ea0cd49e6af2e5a7e3a828b1dc73766d512bcbe2c4f80f4df79fef49b03d53822a52715cd095048305a8b076115ee16d12f5e5a3137b2e0e9795d6f6a72eeaec6ef5e0a85604dd4bd5cb98130103c9177eb61377040ed1f5ca0e4a072004db97bdb185aa90de2b0d4718724f79baff7ac4e18c715e3c955c5b3165dacd077ef1245f28135fb3587e0d5b9a7beb8c65644c682f3391925324ba4bae5094ac7b65a2b8498dbbbef29648e6ef1bdc93c9555bc9", 0xed}, {&(0x7f0000001800)="bb88d01467f9a0f363166f6a4d8cae0aa90c60b70c7b28cc92b122ec79d72b", 0x1f}, {&(0x7f0000001840)="daaf210c7d3a527de99830e0f90864b03fae68e934ede6a8ef48cb806f976b39bf3b39af61db91a735d12ccac5", 0x2d}], 0x6, &(0x7f0000001900)="0e7a454c4c950c0c6ef5bf920ae9eb8b0c1bfdce243c87e70b3031bc0f44274403be6d834b63154e5cc33a6b02cc8254ba7ebe6e81fdf438d8ed926f0eab3deaad876feaf23221797f465c2d902c119a77669a57c60f61250753bbaecd20abbcd3822b02439043e591b18a447fd308558644bff6ede7416cd24caf58e8ebb1baef75", 0x82, 0x40000}, 0x40091)
r6 = socket(0x6, 0x5, 0x0)
r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001a40), 0x40)
splice(r4, &(0x7f0000001a00)=0xffffffffffffffff, r7, &(0x7f0000001a80)=0x8000000000000000, 0x2, 0xe)
r8 = syz_open_dev$vcsn(&(0x7f0000001ac0), 0x3, 0x280)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000001b00)="fb64dc7daa382a6ace87255d9c37cab9a10988aeca82a6aebfa91488ac230d0c67ba3617c91fee66ea6f9e53c41a285605b2f536f00a464ec92433e12b59d962f508f7ee1b51e1beb519ff0d77d442ceab36e4c88175", 0x56)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001bc0), r6)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000001c00)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000001cc0)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x40, r9, 0x904, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x2a}, @val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x6, 0x80}}}}, [@NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_4ADDR={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x400}, 0x0)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000001d00)={0x0, {0x8, 0x5}})
r11 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001d40), 0x802, 0x0)
write$UHID_CREATE2(r11, &(0x7f0000001d80)={0xb, {'syz0\x00', 'syz0\x00', 'syz1\x00', 0xca, 0x5, 0x1ff, 0x70, 0xfffffffc, 0x7a5, "68046d9b2924d7b3359694a5a3799692989d2fb858c9adf9178fe1e3c4fa5ed0c4dd257b3115178264e40046e6efb00c01e00f3f6e3cb4522488e3828f45c5cd217162c946183e56e56f31726e10265cd9118dbba43dce49062d40f427fe6d1201a7d0bfb05ea8871d54b7a3f435b211f47856d2e5f709a966cb6d91da9f1dbfc5c25bcf8f1b36f26eb904c03a53bc094ddb4fd6f1020f458cb071c593a5040a6097e6bbadb780e2f2b6bf5c0c56b068421f472d39894719a1e890372711117ba11608f7f90b6917f6a6"}}, 0x1e2)
r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001f80), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000001fc0)={<r13=>0x0, <r14=>0x0})
write$input_event(r12, &(0x7f0000002000)={{r13, r14/1000+60000}, 0x1, 0x4, 0x5}, 0x18)

9.196171441s ago: executing program 2 (id=3120):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x0, 0x0}, &(0x7f0000000100)=0x10)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000840)={r1, @in6={{0xa, 0x4e22, 0x80, @empty, 0x5d4e}}, 0x7ffffffe, 0x2, 0x614, 0x4, 0xd, 0x7, 0x4}, 0x9c)

9.174685606s ago: executing program 0 (id=3121):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40850)
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f00000000c0)=0x8, 0x4)
r1 = dup(r0)
bind$unix(r1, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, &(0x7f0000000040)=0x7, 0x4)
r2 = dup(0xffffffffffffffff)
mount(&(0x7f0000000000)=@nullb, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='logfs\x00', 0x8006, &(0x7f0000000140)='\'^\x00')
clock_gettime(0x0, &(0x7f0000000240))
syz_io_uring_setup(0x79d4, &(0x7f0000000280)={0x0, 0x921b, 0x4000, 0x0, 0x395, 0x0, r2}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380))
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x1ff}, 0x10}, 0x94)
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r3, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00m'], 0x38}, 0x1, 0x300}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vxcan0\x00'})
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vxcan0\x00'})
name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0)
bind$unix(r2, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e)

9.048834357s ago: executing program 3 (id=3122):
kexec_load(0x3, 0x5, &(0x7f00000005c0)=[{&(0x7f0000000000), 0x0, 0x5, 0xff}, {&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796f1aba03e031312bd7e67403651abac282b310f420dbcdea31d52854783d6952a2a7b10f3e45715203107f8ce516d99c8c7db918e0989ef123cc524fa8ae0af5c952de542a268179439f62e20fb410df0a4c2e54ec355436d7cf9989fa7b13df2f67b", 0xe7, 0x5, 0xffffffff}, {&(0x7f0000000200)="d8f3aabb28de3faf55566e010b6ef42f8002b91bf54d78caa3135bc4a5d30a8fd06d1e70130a8d2b505e9abe3aef1de2219df6f5f695131fe4fc01630cb7751927628d8d7ec59d998200794f89eea832f53f0f9a", 0x54, 0x5, 0x4}, {0x0, 0x0, 0x7, 0x2}, {0x0, 0x0, 0x2, 0xfffffffffffffffa}], 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}], 0x3}, 0x0)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce679", 0x1a}], 0x2, 0x0, 0x0, 0x10}, 0x0)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e33"], 0xd)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5)
r3 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x40000)

8.990911919s ago: executing program 1 (id=3123):
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001"], 0x30}}, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c)
socket$netlink(0x10, 0x3, 0x0)
io_setup(0x3ff, &(0x7f0000000080)=<r0=>0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="a2", 0x1}], 0x1}, 0x4006041)
io_submit(r0, 0x200000e5, &(0x7f0000000080))
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c0000000c0a010100000000000000000a0000070900020073797a31000000000900010073797a0e3850719c535e8362f73100000000300003802c0000800800034000000002200007800e000100636f6e6e6c696d69740000000c000280080001400000000714000000110001000000"], 0x84}, 0x1, 0x0, 0x0, 0x24000850}, 0x4000040)
close(r1)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0482, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = syz_open_dev$sg(&(0x7f0000000040), 0x35e, 0xc0c2)
ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381)

8.903497723s ago: executing program 2 (id=3124):
syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b0001000000000904", @ANYRES16, @ANYRES16], 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0xc}, 0x94)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r1, 0xffffffffffffffff, 0x36, 0x0, @void}, 0x10)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
pivot_root(0x0, &(0x7f0000000180)='.\x00')
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000000e80)={0x2020, 0x0, <r5=>0x0}, 0x2020)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
r8 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r8, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
sendmsg$inet(r8, &(0x7f0000001500)={&(0x7f0000000180)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0)
sendmsg$inet(r8, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91", 0x1}], 0x1}, 0x0)
sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x6c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x28, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}, 0x1, 0x0, 0x0, 0x4044050}, 0x40)
sendmsg$NFT_MSG_GETSET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x20, 0xa, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000084}, 0x44)
write$FUSE_INTERRUPT(0xffffffffffffffff, &(0x7f0000002ec0)={0x10, 0xffffffffffffffda, r5}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[@ANYBLOB="50000000100001040000", @ANYRES32=0x0, @ANYBLOB="5d580000000000001c001a801800209c14000700fc010000000000000000000000000000140003007369743000"/56], 0x50}}, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000010c0)=""/225, 0xe1}], 0x1, 0x7, 0x20000000)

8.786135362s ago: executing program 0 (id=3125):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002})
r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
socket$inet6_mptcp(0xa, 0x1, 0x106)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
getpid()
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000008c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = dup3(r1, r0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f0000007fc0)={0x2020}, 0x2020)

8.574527062s ago: executing program 4 (id=3126):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x802, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x42000, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f"], 0x10b8}, 0x106)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt(r4, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r5 = getpid()
sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x3}, @const={0x0, 0x0, 0x0, 0xb}, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x3e}, 0x20)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c)
sendto$inet6(r4, &(0x7f00000002c0)='E', 0x1, 0x400c0d4, 0x0, 0x0)
close(r4)
ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f0000000040)=@e={0xff, 0x9, 0x0, 0x3, @SEQ_NOTEON=@note=0x7e, 0xa, 0x7f, 0x2})
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)={0x28, r2, 0x1, 0x70bd26, 0x0, {{0x2}, {@void, @val={0xc, 0x99, {0xe7d, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x999}]]}, 0x28}, 0x1, 0x0, 0x0, 0x4020000}, 0x800)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB="18010000756c6c2500000000002020207b1af8ff00000000bfa1000000000000070100001cfeffffb702000008000000b70300000000000085000000ce00000095"], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x2}, 0x94)
r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2)
unshare(0x2040400)

6.7804948s ago: executing program 4 (id=3127):
syz_usb_connect(0x5, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="12011b00538acc089c0e000001000000000904c4c1303a79c03943c6c7d931418075717ed25c8dd5b09a1b138b2c176fab494a80bd8fc8db226ee7b14e387c2c607d9605a460fa08b72e7f9177debc15000000000000000000001211cb16adaa2c5a17398f7cb5117dc03a6648dbd92c8fa65341349f7e", @ANYRESDEC=0x0, @ANYRES16], 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0xc}, 0x94)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r0, 0xffffffffffffffff, 0x36, 0x0, @val=@kprobe_multi=@syms={0x0, 0x3, &(0x7f0000000580)=[&(0x7f00000004c0)='counter\x00', &(0x7f0000000500)='syz1\x00', &(0x7f0000000540)='@\'[-.\x00'], 0x0, 0x8e}}, 0x30)
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040))
r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
connect$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x3ff, @any, 0x7, 0x1}, 0xe)
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}})
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
pivot_root(0x0, &(0x7f0000000180)='.\x00')
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000000e80)={0x2020}, 0x2020)
socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r7, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
sendmsg$inet(r7, &(0x7f0000001500)={&(0x7f0000000180)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0)
sendmsg$inet(r7, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91", 0x1}], 0x1}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x6c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x28, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}, 0x1, 0x0, 0x0, 0x4044050}, 0x40)

5.842810499s ago: executing program 3 (id=3128):
syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0xfffffffffffffffe)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
write(r3, &(0x7f0000000200), 0x0)
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000000)={0x48, 0x5, 0x0, 0x0, <r4=>0xffffffffffffffff})
ioctl$XFS_IOC_BULKSTAT(r4, 0x8040587f, &(0x7f00000009c0)={{0x80000000, 0x6, 0x8, 0x800, 0x8}, &(0x7f0000000500)=[{}, {}, {}]})
r5 = openat$audio1(0xffffffffffffff9c, 0x0, 0x129202, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000140)=0x2000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x20, 0x2c, 0x107, 0x70bd2d, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@generic="552004f1"]}, @nested={0x4, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)
ppoll(&(0x7f0000000040)=[{r5, 0x20}, {r5, 0x13}], 0x2, 0x0, 0x0, 0x0)
mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r5, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000000)=0x4000)
r7 = socket(0x10, 0x3, 0x0)
write(r7, &(0x7f0000000b80)="240100001e005f02140c00fffffffff80700000001000000000000000500e97d11e85637b39c2a6b17eb5629070caf22762c719333a0a27a4a3290424ee6222fe8345672c3d6872da05097dc71ee0a12326400a53caf0019a84af3902493e2bf28e2c0878adbc3180713954b6f9a8d8d5977c7f116038ed2766c109be076346e07a67faccfeb44f1a438a0e603261feaa42d2baa669a013f387d62a48e2ef556fef116d11841a69f83e343968af0d8ec1772513cde1c1e9788a30d673bc6c75bb6e2c0a90add2e8e583da136e4373d4dcf1fb0a1d61258be49b100e57ac6eb60e93b4a3851a1de5d54be076051c3e6d37a834d6c65414502490ed24565d4688b626f37a1cb50219bec4db1f19370fc9d1fd4ecbdde46d976d61173a64a8bec2ee9ff86a8", 0x124)

5.733896126s ago: executing program 1 (id=3129):
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x5, 0x40, 0x6, 0x8}, 0x48)
unshare(0x20000400)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r1}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r2, 0x6}, 0x50)
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
lseek(r3, 0x4, 0x4)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xa0000, 0x0)
mknodat(r3, &(0x7f00000001c0)='./file0\x00', 0x4, 0x370)
ioctl$XFS_IOC_PATH_TO_FSHANDLE(r4, 0xc0385868, &(0x7f0000000540)={<r5=>r0, &(0x7f0000000440)=']}))\\\x00', 0x420640, &(0x7f0000000480)={@align=0x8001, {0x6, 0x4, 0x5, 0xdf4}}, 0xd6b, &(0x7f00000004c0), &(0x7f0000000500)=0x3})
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001b80)={r5}, 0x4)
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001e00)={0x7, <r6=>0x0}, 0x8)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x11, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000008000000000000000fdffffff850000007b000000b7080000000000007b8af8ff00000000b7080000161300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018030000", @ANYRES32], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@fallback=r7, r7, 0x2f, 0x8, 0x0, @void, @value=r7}, 0x20)

4.593086288s ago: executing program 2 (id=3130):
r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
fchdir(r1)
r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40)
write(r4, &(0x7f0000004200)='t', 0x1)
sendfile(r4, r3, 0x0, 0x7fffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x3ffffffe, 0x0, 0x0, 0x0, 0x2}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}, @generic={0xc6, 0x8, 0x0, 0x0, 0xd}, @initr0, @exit, @exit]}, &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94)
ftruncate(r2, 0x2007ffb)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f00000002c0)={0x2, 0xc22, @remote}, 0x10)
getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f0000000040))
r6 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000e70000/0x3000)=nil, &(0x7f0000400000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000823000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000d13000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r7 = io_uring_setup(0x47, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xb, 0x338})
r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff)
ioctl$FICLONE(r8, 0x40049409, r8)
io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0)
bind$inet(r6, &(0x7f0000000340)={0x2, 0x4e23, @loopback}, 0x10)
sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x1a000}}, 0x0)
sendmsg$rds(r6, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendfile(r2, r2, 0x0, 0x1000000201005)

4.367323516s ago: executing program 3 (id=3131):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x7, r1, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000})
pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
write$P9_RFSYNC(r2, &(0x7f0000000100)={0x7, 0x33, 0x2}, 0x7)
close(r0)

4.243695799s ago: executing program 0 (id=3132):
r0 = syz_open_procfs(0x0, 0x0)
epoll_create1(0x0)
futex(0x0, 0x8c, 0x1, 0x0, 0x0, 0x2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x8b}, 0x0)
get_mempolicy(0x0, &(0x7f0000000240), 0x705c, &(0x7f000053e000/0x4000)=nil, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x9})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r4, 0x100000000)
syz_clone(0x4000, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1f00000000000000000000000010"], 0x48)
openat$cgroup_type(r5, &(0x7f0000000340), 0x2, 0x0)

3.097125612s ago: executing program 3 (id=3133):
rseq(0x0, 0x0, 0x10000, 0x0) (fail_nth: 1)

2.816622377s ago: executing program 0 (id=3134):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002000000000000", @ANYRES32=0x0], 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20)
r1 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00', <r3=>0x0})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0)
r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
close(r4)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0x2, 0x80000010, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, 0x1, 0x49050}, [@IFLA_NET_NS_FD={0x8, 0x1c, r4}]}, 0x28}}, 0x4)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000500)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb25026a747e0114370595e4bb0b0489b1dc73229c52bbea23870200000079d3c7a519afc7d2dff1cc9fe1b9bd41c5d0b4f2d04979d68cc3471637e6974031", 0x5a}], 0x1}, 0x20048020)

2.671651s ago: executing program 2 (id=3135):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40850)
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f00000000c0)=0x8, 0x4)
r1 = dup(r0)
bind$unix(r1, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, &(0x7f0000000040)=0x7, 0x4)
r2 = dup(0xffffffffffffffff)
mount(&(0x7f0000000000)=@nullb, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='logfs\x00', 0x8006, &(0x7f0000000140)='\'^\x00')
clock_gettime(0x0, &(0x7f0000000240))
syz_io_uring_setup(0x79d4, &(0x7f0000000280)={0x0, 0x921b, 0x4000, 0x0, 0x395, 0x0, r2}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380))
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x1ff}, 0x10}, 0x94)
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r3, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00m'], 0x38}, 0x1, 0x300}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vxcan0\x00'})
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vxcan0\x00'})
name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0)
bind$unix(r2, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e)

2.642033107s ago: executing program 4 (id=3136):
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff9909080598b2"], 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003080)=ANY=[@ANYBLOB="5c0800002c0007012bbd700000000000057c00000c", @ANYBLOB="2d0529800c00f800030000000000000004006080fa003b800400df00c1becb03dbe55b6c782cebd6a7bc78a21d1bc9f3c1bd441ada5266780599eaf18965bbfcc07c2037129672275c399e1e03f8a0664d807385cc4d566f230400db800400498096d9641e8b1887b25501b11ecd71313a47df368b078d7b825bff33b9eab3964d7b2394b1950c7aeaba6014fe2cd33c89fd070ce0f1f306494a44adf6609d8ad55a5080b36b05cb0b9a57833b14fcd62c0aba0ac67f03b20e87ba6f3610a5bd1d3369ae014c8036c1e596b800991698810ff706e98871c17ad581b0695476273ac6c33a7a51d4a44a5b95684befe95ef49b03458bce89d87355f35b766b242b9f98b661269bb9255d836fb4e30d0000c72ec5561adf6112ca278273b4af42597e7bfa1f5c228f13161b34517c92bc352c017afac22d14047e6fbdc61536f9e51738ea935cb2a577ec2b788433bc13a9e976cfee267f36d988b766a29632c84c94d4cf31d780ef683293d7eacfc93f248d137affcae7cffa699237ea9c74919850dc164f1483f3f352bf7dd787191705b26936e1d090526b6ac5765df318f160cc84b15b94c662cf9261", @ANYBLOB="040044800800c800e00000027a01f380a2b4c1dbd4f221c0a1fd468ca63ae97de147e5bc2d0313377dc17591b491acf18312bee324decf810970090c77ec4ca173b12577aeb13c354245be77050365697b3b4707060c00045e46d612b09c487d7c9c94f778c0a015ecfa70d229085252956142772f9ff5a61a9b7fbc6712f8e64566b7ade87d293b81bd3cd1b2ad2852dc1dbb07d54f5544759f0eb23131b5780de6354f0714b2c5b86323969d0b4f5bd8c4489e0e7471c6a84feb9dead9d156d060a9373c7f80f4f1ec2a87efdeceec8d99c9664ee184f112929fe92da18f26929f98233f18dcbe0c638c040061800400058012fc33716331943112df1a6d89852782e376609e4a38717148d34e9d36191fe607748ad822c89800b204bd5831c55511fc4e85d09c44ef3be8ce710d034d394057d88e12db87eb032cd30fdcb489cd5ac92a44f96b6e463971c730796efaab04ce1b42faea757fc0a50c4feef468c80d7cac7db3bfd67140c04f88892b1d19a91ac5", @ANYRESOCT=r0, @ANYRESDEC=r0], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0x4000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
mremap(&(0x7f00000d5000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000ffd000/0x2000)=nil)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000280)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6c0000000001010400000000141a00000200000b240001801400018008000100e000000108000200e00000010c00280b381686a35f0000002c00028014000180080001000000000008000200ac1e00010c000280050001000000000006000340000100000800074000000001"], 0x6c}}, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000003010104000000000000000002000200240001801400018008000100e000000108000200e00000010c0002800500010000000000"], 0x38}}, 0x0)

2.581039602s ago: executing program 3 (id=3137):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x2, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000400000000000000fd00208510", @ANYRES32], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1e}, 0x94)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_GET_WPAN_PHY(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x28, r2, 0xb15, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x60048c0}, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1c, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41000, 0x62, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9528da7}, 0x94)
r4 = open(&(0x7f00000000c0)='./file0\x00', 0x8e500, 0x2)
ioctl$EVIOCGNAME(r4, 0x80404506, &(0x7f0000000100)=""/30)
userfaultfd(0x800)

1.830241242s ago: executing program 2 (id=3138):
kexec_load(0x3, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000000), 0x0, 0x5, 0xff}, {&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796f1aba03e031312bd7e67403651abac282b310f420dbcdea31d52854783d6952a2a7b10f3e45715203107f8ce516d99c8c7db918e0989ef123cc524fa8ae0af5c952de542a268179439f62e20fb410df0a4c2e54ec355436d7cf9989fa7b13df2f67b", 0xe7, 0x5, 0xffffffff}, {&(0x7f0000000200)="d8f3aabb28de3faf55566e010b6ef42f8002b91bf54d78caa3135bc4a5d30a8fd06d1e70130a8d2b505e9abe3aef1de2219df6f5f695131fe4fc01630cb7751927628d8d7ec59d998200794f89eea832f53f0f9aa4c91322544bc7f07e8cdf4598c9879e4af2de4daca6cf629d11f9c6", 0x70, 0x5, 0x4}, {&(0x7f0000000340)="8c4e55be8948c65379def4df90ce301f71e7d4e4921490b3aacd4082ccf6531bb82dbd4d13dbfbeb16dd11b3c041", 0x2e, 0x100, 0x9}, {0x0, 0x0, 0x7, 0x2}, {0x0, 0x0, 0x2, 0xfffffffffffffffa}], 0x0)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840), 0x1, 0x14018891)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce679", 0x1a}], 0x2, 0x0, 0x0, 0x10}, 0x0)
bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e33"], 0xd)
mkdir(&(0x7f0000000400)='./file0\x00', 0x0)
r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0)
r3 = open_tree(r2, &(0x7f0000000680)='./file0\x00', 0x1)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x200)
move_mount(r3, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x204)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5)
sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x20004000}], 0x1, 0x40800)
recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)}, 0x0)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r4, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3000000800010002000800000000000000000008000300000000001ceb71fec860e1c7"], 0x30}, 0x1, 0x0, 0x0, 0x20000011}, 0x40004)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042)
r7 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r7}})
pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

1.686119491s ago: executing program 3 (id=3139):
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001"], 0x30}}, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c)
socket$netlink(0x10, 0x3, 0x0)
io_setup(0x3ff, &(0x7f0000000080)=<r0=>0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="a2", 0x1}], 0x1}, 0x4006041)
io_submit(r0, 0x200000e5, &(0x7f0000000080))
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c0000000c0a010100000000000000000a0000070900020073797a31000000000900010073797a0e3850719c535e8362f73100000000300003802c0000800800034000000002200007800e000100636f6e6e6c696d69740000000c000280080001400000000714000000110001000000"], 0x84}, 0x1, 0x0, 0x0, 0x24000850}, 0x4000040)
close(r1)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0482, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = syz_open_dev$sg(&(0x7f0000000040), 0x35e, 0xc0c2)
ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381)

1.352736849s ago: executing program 1 (id=3140):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r0, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x38}, 0x1, 0x300}, 0x0)

0s ago: executing program 0 (id=3141):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r1, 0x1, 0x4a, &(0x7f0000001600), 0x4)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff)
syz_usb_connect(0x3, 0x24, &(0x7f0000000dc0)=ANY=[@ANYBLOB="12010003cb8e3d10fd0b24012ff5010203010902120001150db0040904cd0100e218c30c"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0})
r3 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000100)=0x4)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x5, {"2ac78ef8fe04856af9ca71f0d3fe13be", "000000e4e405b5e9f99a00", '\x00\x00\x00\x001\x00\t\x00'}, 0x0, 0x4})
sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x34, r2, 0x1, 0x0, 0x0, {0x2c}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x4000)

kernel console output (not intermixed with test programs):

fig 0 descriptor??
[ 1145.204811][T13998] usb 4-1: new full-speed USB device number 18 using dummy_hcd
[ 1145.282396][    T9] usb 2-1: can't set config #0, error -71
[ 1145.294996][    T9] usb 2-1: USB disconnect, device number 97
[ 1145.333246][   T37] audit: type=1804 audit(1780130216.507:490): pid=14781 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.2890" name="bus" dev="ramfs" ino=46186 res=1 errno=0
[ 1145.333992][   T37] audit: type=1804 audit(1780130216.507:491): pid=14781 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.0.2890" name="bus" dev="ramfs" ino=46186 res=1 errno=0
[ 1145.389000][T13998] usb 4-1: config 8 has an invalid interface number: 223 but max is 0
[ 1145.389028][T13998] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config
[ 1145.389047][T13998] usb 4-1: config 8 has no interface number 0
[ 1145.389106][T13998] usb 4-1: config 8 interface 223 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[ 1145.391447][T13998] usb 4-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d
[ 1145.391473][T13998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1145.391493][T13998] usb 4-1: Product: syz
[ 1145.391507][T13998] usb 4-1: Manufacturer: syz
[ 1145.391522][T13998] usb 4-1: SerialNumber: syz
[ 1145.691779][   T37] audit: type=1804 audit(1780130216.867:492): pid=14787 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.2893" name="bus" dev="ramfs" ino=45882 res=1 errno=0
[ 1145.694325][   T37] audit: type=1804 audit(1780130216.867:493): pid=14787 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.1.2893" name="bus" dev="ramfs" ino=45882 res=1 errno=0
[ 1145.917145][T13998] usb 4-1: USB disconnect, device number 18
[ 1146.604790][    T9] usb 3-1: new full-speed USB device number 17 using dummy_hcd
[ 1146.778319][    T9] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[ 1146.781566][    T9] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b
[ 1146.781595][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1146.781615][    T9] usb 3-1: Product: syz
[ 1146.781631][    T9] usb 3-1: Manufacturer: syz
[ 1146.781645][    T9] usb 3-1: SerialNumber: syz
[ 1146.852755][    T9] usb 3-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state
[ 1147.366526][T13998] usb 5-1: new high-speed USB device number 7 using dummy_hcd
[ 1147.465088][T14800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1147.470399][T14800] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1148.063446][T13998] usb 5-1: config 220 has an invalid interface number: 76 but max is 2
[ 1148.063534][T13998] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[ 1148.063601][T13998] usb 5-1: config 220 has no interface number 2
[ 1148.096484][T13998] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[ 1148.096518][T13998] usb 5-1: config 220 interface 0 has no altsetting 0
[ 1148.096536][T13998] usb 5-1: config 220 interface 76 has no altsetting 0
[ 1148.096555][T13998] usb 5-1: config 220 interface 1 has no altsetting 0
[ 1148.104268][T13998] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[ 1148.104295][T13998] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1148.104315][T13998] usb 5-1: Product: syz
[ 1148.104330][T13998] usb 5-1: Manufacturer: syz
[ 1148.104344][T13998] usb 5-1: SerialNumber: syz
[ 1148.519895][T13998] usb 5-1: selecting invalid altsetting 0
[ 1148.521680][T13998] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07)
[ 1148.521710][T13998] uvcvideo 5-1:220.0: No valid video chain found.
[ 1148.572538][T13998] usb 5-1: selecting invalid altsetting 0
[ 1148.572575][T13998] usbtest 5-1:220.1: probe with driver usbtest failed with error -22
[ 1148.598082][T13998] usb 5-1: USB disconnect, device number 7
[ 1148.964936][ T5986] usb 4-1: new full-speed USB device number 19 using dummy_hcd
[ 1149.226702][T14812] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2899'.
[ 1150.034517][ T5986] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[ 1150.034550][ T5986] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1150.034572][ T5986] usb 4-1: Product: syz
[ 1150.034587][ T5986] usb 4-1: Manufacturer: syz
[ 1150.034602][ T5986] usb 4-1: SerialNumber: syz
[ 1150.141024][    T9] usb 3-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter)
[ 1150.162692][ T5986] usb 4-1: config 0 descriptor??
[ 1150.317962][ T5986] gspca_main: stk1135-2.14.0 probing 174f:6a31
[ 1150.329839][    T9] usb 3-1: USB disconnect, device number 17
[ 1150.422983][T14817] netlink: 136 bytes leftover after parsing attributes in process `syz.0.2900'.
[ 1151.431609][T14827] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2903'.
[ 1151.793084][T13998] usb 5-1: new full-speed USB device number 8 using dummy_hcd
[ 1151.882267][T14830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 1151.936080][T14830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 1151.955358][T14830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 1151.982568][T13998] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1151.982595][T13998] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1151.985408][T14830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 1151.986302][T14830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 1152.045509][T13998] usb 5-1: config 0 descriptor??
[ 1152.311789][T13998] pwc: Samsung MPC-C10 USB webcam detected.
[ 1152.335324][T13998] pwc: send_video_command error -71
[ 1152.335340][T13998] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1152.335571][T13998] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71
[ 1152.396760][T13998] usb 5-1: USB disconnect, device number 8
[ 1152.571863][   T37] audit: type=1804 audit(1780130223.547:494): pid=14839 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.2906" name="bus" dev="ramfs" ino=46287 res=1 errno=0
[ 1152.582146][   T37] audit: type=1804 audit(1780130223.757:495): pid=14840 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.2906" name="bus" dev="ramfs" ino=46287 res=1 errno=0
[ 1153.640436][ T5986] gspca_stk1135: reg_w 0x203 err -71
[ 1153.642743][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642760][ T5986] gspca_stk1135: Sensor write failed
[ 1153.642788][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642798][ T5986] gspca_stk1135: Sensor write failed
[ 1153.642826][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642836][ T5986] gspca_stk1135: Sensor read failed
[ 1153.642863][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642872][ T5986] gspca_stk1135: Sensor read failed
[ 1153.642880][ T5986] gspca_stk1135: Detected sensor type unknown (0x0)
[ 1153.642913][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642923][ T5986] gspca_stk1135: Sensor read failed
[ 1153.642948][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642958][ T5986] gspca_stk1135: Sensor read failed
[ 1153.642984][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.642993][ T5986] gspca_stk1135: Sensor write failed
[ 1153.643031][ T5986] gspca_stk1135: serial bus timeout: status=0x00
[ 1153.643040][ T5986] gspca_stk1135: Sensor write failed
[ 1153.662058][ T5986] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71
[ 1153.759539][ T5986] usb 4-1: USB disconnect, device number 19
[ 1153.913171][T14828] dummy0 speed is unknown, defaulting to 1000
[ 1154.386148][   T59] Bluetooth: hci0: command tx timeout
[ 1154.601835][T14859] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2908'.
[ 1156.203928][ T5986] hid (null): invalid report_count 395657798
[ 1156.203944][ T5986] hid (null): unknown global tag 0xc
[ 1156.203952][ T5986] hid (null): bogus close delimiter
[ 1156.203958][ T5986] hid (null): unknown global tag 0xc
[ 1156.204019][ T5986] hid (null): unknown global tag 0xd
[ 1156.204026][ T5986] hid (null): unknown global tag 0xbb
[ 1156.204076][ T5986] hid (null): unknown global tag 0xe
[ 1156.204089][ T5986] hid (null): bogus close delimiter
[ 1156.204102][ T5986] hid (null): invalid report_size -2061915488
[ 1156.204117][ T5986] hid (null): invalid report_size 23318
[ 1156.204131][ T5986] hid (null): unknown global tag 0xc
[ 1156.204154][ T5986] hid (null): unknown global tag 0xe
[ 1156.204188][ T5986] hid (null): invalid report_size -845816829
[ 1156.204203][ T5986] hid (null): invalid report_count 43168
[ 1156.204217][ T5986] hid (null): invalid report_count -1269364438
[ 1156.204251][ T5986] hid (null): invalid report_count -1623847985
[ 1156.204265][ T5986] hid (null): invalid report_size 17710
[ 1156.204272][ T5986] hid (null): unknown global tag 0xd
[ 1156.205710][ T5986] hid (null): nested delimiters
[ 1156.205771][ T5986] hid (null): unknown global tag 0x18
[ 1156.206536][ T5986] hid (null): unknown global tag 0xd
[ 1156.206558][ T5986] hid (null): unknown global tag 0xd
[ 1156.206565][ T5986] hid (null): unknown global tag 0xd
[ 1156.207309][ T5986] hid (null): global environment stack underflow
[ 1156.207316][ T5986] hid (null): unknown global tag 0xce
[ 1156.207337][ T5986] hid (null): unknown global tag 0xe
[ 1156.207344][ T5986] hid (null): unknown global tag 0x30
[ 1156.207366][ T5986] hid (null): unknown global tag 0xcc
[ 1156.207393][ T5986] hid (null): invalid report_size 35267
[ 1156.207427][ T5986] hid (null): unknown global tag 0xc
[ 1156.207434][ T5986] hid (null): global environment stack underflow
[ 1156.208244][ T5986] hid (null): unknown global tag 0xd
[ 1156.208433][ T5986] hid (null): unknown global tag 0x91
[ 1156.208460][ T5986] hid (null): unknown global tag 0xe
[ 1156.208493][ T5986] hid (null): unknown global tag 0xe
[ 1156.208520][ T5986] hid (null): unknown global tag 0xd
[ 1156.208527][ T5986] hid (null): bogus close delimiter
[ 1156.254821][ T5612] usb 3-1: new high-speed USB device number 18 using dummy_hcd
[ 1156.266092][ T5986] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0036: invalid report_count 395657798
[ 1156.266106][ T5986] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0036: item 0 4 1 9 parsing failed
[ 1156.304868][ T5747] usb 2-1: new full-speed USB device number 98 using dummy_hcd
[ 1156.334927][    T9] usb 5-1: new high-speed USB device number 9 using dummy_hcd
[ 1156.397668][ T5986] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0036: probe with driver hid-generic failed with error -22
[ 1156.406763][ T5612] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1156.406810][ T5612] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[ 1156.406832][ T5612] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1156.411660][   T59] Bluetooth: hci0: command tx timeout
[ 1156.437154][ T5612] usb 3-1: config 0 descriptor??
[ 1156.457315][ T5747] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[ 1156.460081][ T5747] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b
[ 1156.460108][ T5747] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1156.460128][ T5747] usb 2-1: Product: syz
[ 1156.460150][ T5747] usb 2-1: Manufacturer: syz
[ 1156.460164][ T5747] usb 2-1: SerialNumber: syz
[ 1156.481098][ T5747] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state
[ 1156.497642][    T9] usb 5-1: config 220 has an invalid interface number: 76 but max is 2
[ 1156.497668][    T9] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[ 1156.497688][    T9] usb 5-1: config 220 has no interface number 2
[ 1156.497803][    T9] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[ 1156.497830][    T9] usb 5-1: config 220 interface 0 has no altsetting 0
[ 1156.497848][    T9] usb 5-1: config 220 interface 76 has no altsetting 0
[ 1156.497866][    T9] usb 5-1: config 220 interface 1 has no altsetting 0
[ 1156.501783][    T9] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[ 1156.501810][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1156.501879][    T9] usb 5-1: Product: syz
[ 1156.501895][    T9] usb 5-1: Manufacturer: syz
[ 1156.501909][    T9] usb 5-1: SerialNumber: syz
[ 1156.667614][ T5612] pwc: Askey VC010 type 2 USB webcam detected.
[ 1156.923403][ T5612] pwc: recv_control_msg error -32 req 02 val 2b00
[ 1156.930892][ T5612] pwc: recv_control_msg error -32 req 02 val 2700
[ 1156.934211][ T5612] pwc: recv_control_msg error -32 req 02 val 2c00
[ 1156.936620][ T5612] pwc: recv_control_msg error -32 req 04 val 1000
[ 1156.941823][ T5612] pwc: recv_control_msg error -32 req 04 val 1300
[ 1156.944799][ T5612] pwc: recv_control_msg error -32 req 04 val 1400
[ 1156.946851][ T5612] pwc: recv_control_msg error -32 req 02 val 2000
[ 1156.950915][ T5612] pwc: recv_control_msg error -32 req 02 val 2100
[ 1156.975490][ T5612] pwc: recv_control_msg error -32 req 04 val 1500
[ 1156.994260][ T5612] pwc: recv_control_msg error -32 req 02 val 2500
[ 1157.415429][T14884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1157.421235][T14884] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1157.711582][ T5612] pwc: recv_control_msg error -32 req 02 val 2400
[ 1157.736244][ T5612] pwc: recv_control_msg error -32 req 02 val 2600
[ 1157.976376][    T9] usb 5-1: selecting invalid altsetting 0
[ 1158.040220][    T9] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07)
[ 1158.040328][    T9] uvcvideo 5-1:220.0: No valid video chain found.
[ 1158.082651][T14828] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1158.082959][T14828] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1158.083271][T14828] bridge_slave_0: entered allmulticast mode
[ 1158.122663][T14828] bridge_slave_0: entered promiscuous mode
[ 1158.138627][T14828] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1158.138899][T14828] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1158.139196][T14828] bridge_slave_1: entered allmulticast mode
[ 1158.162756][ T5612] pwc: recv_control_msg error -71 req 02 val 2900
[ 1158.163331][ T5612] pwc: recv_control_msg error -71 req 02 val 2800
[ 1158.163960][ T5612] pwc: recv_control_msg error -71 req 04 val 1100
[ 1158.164412][ T5612] pwc: recv_control_msg error -71 req 04 val 1200
[ 1158.172418][T14828] bridge_slave_1: entered promiscuous mode
[ 1158.176395][    T9] usb 5-1: selecting invalid altsetting 0
[ 1158.176427][    T9] usbtest 5-1:220.1: probe with driver usbtest failed with error -22
[ 1158.259762][    T9] usb 5-1: USB disconnect, device number 9
[ 1158.275274][ T5612] pwc: Registered as video103.
[ 1158.318275][ T5612] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input103
[ 1158.392852][ T5612] usb 3-1: USB disconnect, device number 18
[ 1158.485298][   T59] Bluetooth: hci0: command tx timeout
[ 1158.562960][T14828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 1158.697081][T14828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 1159.002843][T14892] comedi: No check for data length of config insn id 5 is implemented
[ 1159.002855][T14892] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c
[ 1159.002868][T14892] comedi: Assuming n=37507 is correct
[ 1159.122971][ T5747] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter)
[ 1159.227757][ T5747] usb 2-1: USB disconnect, device number 98
[ 1159.281866][   T37] audit: type=1804 audit(1780130230.457:496): pid=14894 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.2917" name="bus" dev="ramfs" ino=47113 res=1 errno=0
[ 1159.289940][   T37] audit: type=1804 audit(1780130230.457:497): pid=14894 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.2917" name="bus" dev="ramfs" ino=47113 res=1 errno=0
[ 1159.584856][ T5612] usb 4-1: new full-speed USB device number 20 using dummy_hcd
[ 1159.604502][   T56] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1159.739350][ T5612] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[ 1159.739380][ T5612] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1159.739400][ T5612] usb 4-1: Product: syz
[ 1159.739414][ T5612] usb 4-1: Manufacturer: syz
[ 1159.739428][ T5612] usb 4-1: SerialNumber: syz
[ 1159.743489][ T5612] usb 4-1: config 0 descriptor??
[ 1159.755850][ T5612] gspca_main: stk1135-2.14.0 probing 174f:6a31
[ 1159.874908][ T5986] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[ 1159.936925][T14905] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2921'.
[ 1160.033614][ T5986] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[ 1160.033646][ T5986] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1160.033723][ T5986] usb 5-1: Product: syz
[ 1160.033738][ T5986] usb 5-1: Manufacturer: syz
[ 1160.033754][ T5986] usb 5-1: SerialNumber: syz
[ 1160.050246][ T5986] usb 5-1: config 0 descriptor??
[ 1160.134045][T14828] team0: Port device team_slave_0 added
[ 1160.150765][T14828] team0: Port device team_slave_1 added
[ 1160.197368][T14828] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 1160.197383][T14828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 1160.197410][T14828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 1160.199483][T14828] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 1160.199496][T14828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 1160.199523][T14828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 1160.374167][T14828] hsr_slave_0: entered promiscuous mode
[ 1160.383583][T14828] hsr_slave_1: entered promiscuous mode
[ 1160.384303][T14828] debugfs: 'hsr0' already exists in 'hsr'
[ 1160.384323][T14828] Cannot create hsr debugfs directory
[ 1160.565384][   T59] Bluetooth: hci0: command tx timeout
[ 1160.709330][T14908] FAULT_INJECTION: forcing a failure.
[ 1160.709330][T14908] name failslab, interval 1, probability 0, space 0, times 0
[ 1160.709352][T14908] CPU: 1 UID: 0 PID: 14908 Comm: syz.1.2922 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1160.709366][T14908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1160.709372][T14908] Call Trace:
[ 1160.709377][T14908]  <TASK>
[ 1160.709382][T14908]  dump_stack_lvl+0xe8/0x150
[ 1160.709401][T14908]  should_fail_ex+0x46b/0x600
[ 1160.709420][T14908]  should_failslab+0xa8/0x100
[ 1160.709436][T14908]  kmem_cache_alloc_noprof+0x87/0x680
[ 1160.709449][T14908]  ? __netlink_lookup+0xc6/0x8b0
[ 1160.709464][T14908]  ? skb_clone+0x212/0x3a0
[ 1160.709482][T14908]  skb_clone+0x212/0x3a0
[ 1160.709499][T14908]  __netlink_deliver_tap+0x404/0x850
[ 1160.709519][T14908]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1160.709534][T14908]  netlink_deliver_tap+0x19c/0x1b0
[ 1160.709548][T14908]  netlink_unicast+0x754/0x920
[ 1160.709567][T14908]  netlink_sendmsg+0x813/0xb40
[ 1160.709585][T14908]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1160.709601][T14908]  ? unwind_get_return_address+0x4d/0x90
[ 1160.709617][T14908]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 1160.709631][T14908]  ____sys_sendmsg+0x94c/0x9c0
[ 1160.709648][T14908]  ? __pfx_____sys_sendmsg+0x10/0x10
[ 1160.709667][T14908]  ? import_iovec+0x73/0xa0
[ 1160.709685][T14908]  ___sys_sendmsg+0x2a5/0x360
[ 1160.709699][T14908]  ? __lock_acquire+0x6b5/0x2cf0
[ 1160.709716][T14908]  ? __pfx____sys_sendmsg+0x10/0x10
[ 1160.709748][T14908]  ? __fget_files+0x2a/0x420
[ 1160.709758][T14908]  ? __fget_files+0x3a6/0x420
[ 1160.709773][T14908]  __x64_sys_sendmsg+0x1c3/0x2a0
[ 1160.709790][T14908]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 1160.709809][T14908]  ? __pfx_ksys_write+0x10/0x10
[ 1160.709826][T14908]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1160.709838][T14908]  do_syscall_64+0x174/0x580
[ 1160.709854][T14908]  ? clear_bhb_loop+0x40/0x90
[ 1160.709866][T14908]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1160.709877][T14908] RIP: 0033:0x7fc5882ece59
[ 1160.709888][T14908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1160.709897][T14908] RSP: 002b:00007fc58653e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1160.709909][T14908] RAX: ffffffffffffffda RBX: 00007fc588565fa0 RCX: 00007fc5882ece59
[ 1160.709917][T14908] RDX: 0000000002000800 RSI: 0000200000000000 RDI: 0000000000000004
[ 1160.709924][T14908] RBP: 00007fc58653e090 R08: 0000000000000000 R09: 0000000000000000
[ 1160.709930][T14908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1160.709937][T14908] R13: 00007fc588566038 R14: 00007fc588565fa0 R15: 00007ffe26391848
[ 1160.709954][T14908]  </TASK>
[ 1160.930395][ T5986] usb 5-1: Firmware version (0.0) predates our first public release.
[ 1160.930504][ T5986] usb 5-1: Please update to version 0.2 or newer
[ 1161.175393][   T56] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1161.570589][ T5986] usb 5-1: USB disconnect, device number 10
[ 1162.078432][ T5612] gspca_stk1135: reg_w 0x203 err -71
[ 1162.079470][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079484][ T5612] gspca_stk1135: Sensor write failed
[ 1162.079510][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079521][ T5612] gspca_stk1135: Sensor write failed
[ 1162.079548][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079559][ T5612] gspca_stk1135: Sensor read failed
[ 1162.079598][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079608][ T5612] gspca_stk1135: Sensor read failed
[ 1162.079616][ T5612] gspca_stk1135: Detected sensor type unknown (0x0)
[ 1162.079736][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079746][ T5612] gspca_stk1135: Sensor read failed
[ 1162.079770][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079780][ T5612] gspca_stk1135: Sensor read failed
[ 1162.079806][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079816][ T5612] gspca_stk1135: Sensor write failed
[ 1162.079842][ T5612] gspca_stk1135: serial bus timeout: status=0x00
[ 1162.079851][ T5612] gspca_stk1135: Sensor write failed
[ 1162.079956][ T5612] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71
[ 1162.104294][ T5612] usb 4-1: USB disconnect, device number 20
[ 1162.223995][   T56] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1163.719295][T14935] comedi: No check for data length of config insn id 5 is implemented
[ 1163.719312][T14935] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c
[ 1163.719323][T14935] comedi: Assuming n=37506 is correct
[ 1163.845323][   T56] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1164.287907][ T5986] usb 5-1: new high-speed USB device number 11 using dummy_hcd
[ 1164.329047][   T37] audit: type=1804 audit(1780130235.507:498): pid=14941 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.2933" name="bus" dev="ramfs" ino=46494 res=1 errno=0
[ 1164.329100][   T37] audit: type=1804 audit(1780130235.507:499): pid=14941 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.3.2933" name="bus" dev="ramfs" ino=46494 res=1 errno=0
[ 1164.436534][ T5986] usb 5-1: config 220 has an invalid interface number: 76 but max is 2
[ 1164.436562][ T5986] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[ 1164.436582][ T5986] usb 5-1: config 220 has no interface number 2
[ 1164.436631][ T5986] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[ 1164.436645][ T5986] usb 5-1: config 220 interface 0 has no altsetting 0
[ 1164.436655][ T5986] usb 5-1: config 220 interface 76 has no altsetting 0
[ 1164.436664][ T5986] usb 5-1: config 220 interface 1 has no altsetting 0
[ 1164.439105][ T5986] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[ 1164.439133][ T5986] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1164.439147][ T5986] usb 5-1: Product: syz
[ 1164.439155][ T5986] usb 5-1: Manufacturer: syz
[ 1164.439163][ T5986] usb 5-1: SerialNumber: syz
[ 1164.904608][ T5986] usb 5-1: selecting invalid altsetting 0
[ 1164.957765][ T5986] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07)
[ 1164.957800][ T5986] uvcvideo 5-1:220.0: No valid video chain found.
[ 1165.242702][ T5986] usb 5-1: selecting invalid altsetting 0
[ 1165.242740][ T5986] usbtest 5-1:220.1: probe with driver usbtest failed with error -22
[ 1165.263076][ T5986] usb 5-1: USB disconnect, device number 11
[ 1166.135187][   T56] bridge_slave_1: left allmulticast mode
[ 1166.135211][   T56] bridge_slave_1: left promiscuous mode
[ 1166.135373][   T56] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1166.493058][   T56] bridge_slave_0: left allmulticast mode
[ 1166.493093][   T56] bridge_slave_0: left promiscuous mode
[ 1166.522552][   T56] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1166.697263][   T56] dvmrp1: left allmulticast mode
[ 1166.864865][ T5986] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[ 1167.024458][ T5986] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[ 1167.024488][ T5986] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1167.024508][ T5986] usb 3-1: Product: syz
[ 1167.024520][ T5986] usb 3-1: Manufacturer: syz
[ 1167.024527][ T5986] usb 3-1: SerialNumber: syz
[ 1167.043508][ T5986] usb 3-1: config 0 descriptor??
[ 1167.781181][ T5986] usb 3-1: Firmware version (0.0) predates our first public release.
[ 1167.781200][ T5986] usb 3-1: Please update to version 0.2 or newer
[ 1168.337976][T11551] hid (null): invalid report_count 395657798
[ 1168.338000][T11551] hid (null): unknown global tag 0xc
[ 1168.338023][T11551] hid (null): bogus close delimiter
[ 1168.338035][T11551] hid (null): unknown global tag 0xc
[ 1168.338135][T11551] hid (null): unknown global tag 0xd
[ 1168.338148][T11551] hid (null): unknown global tag 0xbb
[ 1168.338227][T11551] hid (null): unknown global tag 0xe
[ 1168.338251][T11551] hid (null): bogus close delimiter
[ 1168.338274][T11551] hid (null): invalid report_size -2061915488
[ 1168.338300][T11551] hid (null): invalid report_size 23318
[ 1168.338324][T11551] hid (null): unknown global tag 0xc
[ 1168.338358][T11551] hid (null): unknown global tag 0xe
[ 1168.338414][T11551] hid (null): invalid report_size -845816829
[ 1168.338440][T11551] hid (null): invalid report_count 43168
[ 1168.338464][T11551] hid (null): invalid report_count -1269364438
[ 1168.338522][T11551] hid (null): invalid report_count -1623847985
[ 1168.338547][T11551] hid (null): invalid report_size 17710
[ 1168.338560][T11551] hid (null): unknown global tag 0xd
[ 1168.341694][T11551] hid (null): nested delimiters
[ 1168.341766][T11551] hid (null): unknown global tag 0x18
[ 1168.344336][T11551] hid (null): unknown global tag 0xd
[ 1168.344376][T11551] hid (null): unknown global tag 0xd
[ 1168.344390][T11551] hid (null): unknown global tag 0xd
[ 1168.359806][T11551] hid (null): global environment stack underflow
[ 1168.359824][T11551] hid (null): unknown global tag 0xce
[ 1168.359858][T11551] hid (null): unknown global tag 0xe
[ 1168.359871][T11551] hid (null): unknown global tag 0x30
[ 1168.359907][T11551] hid (null): unknown global tag 0xcc
[ 1168.359951][T11551] hid (null): invalid report_size 35267
[ 1168.360005][T11551] hid (null): unknown global tag 0xc
[ 1168.360024][T11551] hid (null): global environment stack underflow
[ 1168.363638][T11551] hid (null): unknown global tag 0xd
[ 1168.363799][T11551] hid (null): unknown global tag 0x91
[ 1168.363847][T11551] hid (null): unknown global tag 0xe
[ 1168.363900][T11551] hid (null): unknown global tag 0xe
[ 1168.363943][T11551] hid (null): unknown global tag 0xd
[ 1168.363957][T11551] hid (null): bogus close delimiter
[ 1168.378121][T11551] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0037: invalid report_count 395657798
[ 1168.378143][T11551] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0037: item 0 4 1 9 parsing failed
[ 1168.379231][T11551] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0037: probe with driver hid-generic failed with error -22
[ 1168.762179][   T37] audit: type=1804 audit(1780130239.937:500): pid=15000 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.2947" name="bus" dev="ramfs" ino=47414 res=1 errno=0
[ 1168.762750][   T37] audit: type=1804 audit(1780130239.937:501): pid=15000 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.2947" name="bus" dev="ramfs" ino=47414 res=1 errno=0
[ 1168.965113][T11551] usb 4-1: new high-speed USB device number 21 using dummy_hcd
[ 1169.447027][T11551] usb 4-1: config 220 has an invalid interface number: 76 but max is 2
[ 1169.447056][T11551] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[ 1169.447076][T11551] usb 4-1: config 220 has no interface number 2
[ 1169.447359][T11551] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[ 1169.447550][T11551] usb 4-1: config 220 interface 0 has no altsetting 0
[ 1169.447993][T11551] usb 4-1: config 220 interface 76 has no altsetting 0
[ 1169.448014][T11551] usb 4-1: config 220 interface 1 has no altsetting 0
[ 1169.492784][T11551] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[ 1169.493119][T11551] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1169.493173][T11551] usb 4-1: Product: syz
[ 1169.493224][T11551] usb 4-1: Manufacturer: syz
[ 1169.493239][T11551] usb 4-1: SerialNumber: syz
[ 1170.860757][   T56] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 1170.971933][   T56] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 1171.012624][   T56] bond0 (unregistering): Released all slaves
[ 1171.018710][T11551] usb 4-1: selecting invalid altsetting 0
[ 1171.025295][T11551] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07)
[ 1171.025328][T11551] uvcvideo 4-1:220.0: No valid video chain found.
[ 1171.082731][   T56] bond1 (unregistering): Released all slaves
[ 1171.105320][T11551] usb 4-1: selecting invalid altsetting 0
[ 1171.105359][T11551] usbtest 4-1:220.1: probe with driver usbtest failed with error -22
[ 1171.139986][T11551] usb 4-1: USB disconnect, device number 21
[ 1171.189419][   T56] bond2 (unregistering): Released all slaves
[ 1171.249033][   T56] bond3 (unregistering): Released all slaves
[ 1171.323649][   T56] bond4 (unregistering): Released all slaves
[ 1171.356006][   T56] bond5 (unregistering): Released all slaves
[ 1171.382459][   T56] bond6 (unregistering): Released all slaves
[ 1171.399113][   T56] bond7 (unregistering): Released all slaves
[ 1171.418683][   T56] bond8 (unregistering): Released all slaves
[ 1171.436052][   T56] bond9 (unregistering): Released all slaves
[ 1171.586886][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1
[ 1171.746312][T15004] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1171.788590][T15004] bridge_slave_0 (unregistering): left allmulticast mode
[ 1171.788613][T15004] bridge_slave_0 (unregistering): left promiscuous mode
[ 1171.788666][T15004] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1172.308781][ T5986] usb 3-1: USB disconnect, device number 19
[ 1172.794859][ T5615] usb 2-1: new high-speed USB device number 99 using dummy_hcd
[ 1172.946993][ T5615] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[ 1172.947048][ T5615] usb 2-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00
[ 1172.947072][ T5615] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1172.953757][ T5615] usb 2-1: config 0 descriptor??
[ 1172.994420][T15017] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[ 1173.468942][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.468978][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469004][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469062][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469089][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469115][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469142][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469169][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469195][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.469221][ T5615] asus 0003:0B05:1ABE.0038: unknown main item tag 0x0
[ 1173.472535][ T5615] asus 0003:0B05:1ABE.0038: reserved main item tag 0xd
[ 1173.478095][ T5615] asus 0003:0B05:1ABE.0038: hidraw0: USB HID v7f.fd Device [HID 0b05:1abe] on usb-dummy_hcd.1-1/input0
[ 1174.010473][ T5615] asus 0003:0B05:1ABE.0038: Asus handshake 5a failed to receive ack: -32
[ 1174.017637][T15030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1174.036774][T15030] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1174.321568][ T5615] hid (null): invalid report_count 395657798
[ 1174.321592][ T5615] hid (null): unknown global tag 0xc
[ 1174.321605][ T5615] hid (null): bogus close delimiter
[ 1174.321617][ T5615] hid (null): unknown global tag 0xc
[ 1174.321711][ T5615] hid (null): unknown global tag 0xd
[ 1174.321724][ T5615] hid (null): unknown global tag 0xbb
[ 1174.321744][ T5747] usb 2-1: USB disconnect, device number 99
[ 1174.321797][ T5615] hid (null): unknown global tag 0xe
[ 1174.321820][ T5615] hid (null): bogus close delimiter
[ 1174.321842][ T5615] hid (null): invalid report_size -2061915488
[ 1174.321866][ T5615] hid (null): invalid report_size 23318
[ 1174.321890][ T5615] hid (null): unknown global tag 0xc
[ 1174.321923][ T5615] hid (null): unknown global tag 0xe
[ 1174.321976][ T5615] hid (null): invalid report_size -845816829
[ 1174.322001][ T5615] hid (null): invalid report_count 43168
[ 1174.322025][ T5615] hid (null): invalid report_count -1269364438
[ 1174.322081][ T5615] hid (null): invalid report_count -1623847985
[ 1174.322106][ T5615] hid (null): invalid report_size 17710
[ 1174.322118][ T5615] hid (null): unknown global tag 0xd
[ 1174.323792][ T5615] hid (null): nested delimiters
[ 1174.438238][ T5615] hid (null): unknown global tag 0x18
[ 1174.439494][ T5615] hid (null): unknown global tag 0xd
[ 1174.439532][ T5615] hid (null): unknown global tag 0xd
[ 1174.439544][ T5615] hid (null): unknown global tag 0xd
[ 1174.443765][ T5615] hid (null): global environment stack underflow
[ 1174.443781][ T5615] hid (null): unknown global tag 0xce
[ 1174.443818][ T5615] hid (null): unknown global tag 0xe
[ 1174.443832][ T5615] hid (null): unknown global tag 0x30
[ 1174.443869][ T5615] hid (null): unknown global tag 0xcc
[ 1174.443914][ T5615] hid (null): invalid report_size 35267
[ 1174.443971][ T5615] hid (null): unknown global tag 0xc
[ 1174.443984][ T5615] hid (null): global environment stack underflow
[ 1174.515588][ T5615] hid (null): unknown global tag 0xd
[ 1174.515739][ T5615] hid (null): unknown global tag 0x91
[ 1174.515801][ T5615] hid (null): unknown global tag 0xe
[ 1174.517366][ T5615] hid (null): unknown global tag 0xe
[ 1174.517413][ T5615] hid (null): unknown global tag 0xd
[ 1174.517428][ T5615] hid (null): bogus close delimiter
[ 1174.595631][ T5615] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0039: invalid report_count 395657798
[ 1174.595654][ T5615] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0039: item 0 4 1 9 parsing failed
[ 1174.596348][ T5615] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.0039: probe with driver hid-generic failed with error -22
[ 1174.847603][ T5727] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[ 1174.941024][    T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[ 1175.029777][ T5727] usb 3-1: config 220 has an invalid interface number: 76 but max is 2
[ 1175.029806][ T5727] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config
[ 1175.029826][ T5727] usb 3-1: config 220 has no interface number 2
[ 1175.029907][ T5727] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12
[ 1175.029935][ T5727] usb 3-1: config 220 interface 0 has no altsetting 0
[ 1175.029954][ T5727] usb 3-1: config 220 interface 76 has no altsetting 0
[ 1175.029973][ T5727] usb 3-1: config 220 interface 1 has no altsetting 0
[ 1175.033939][ T5727] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9
[ 1175.033969][ T5727] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1175.033989][ T5727] usb 3-1: Product: syz
[ 1175.034003][ T5727] usb 3-1: Manufacturer: syz
[ 1175.034018][ T5727] usb 3-1: SerialNumber: syz
[ 1175.136757][    T9] usb 5-1: Using ep0 maxpacket: 8
[ 1175.144150][    T9] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64
[ 1175.144180][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1175.144201][    T9] usb 5-1: Product: syz
[ 1175.144215][    T9] usb 5-1: Manufacturer: syz
[ 1175.144230][    T9] usb 5-1: SerialNumber: syz
[ 1175.176963][    T9] usb 5-1: config 0 descriptor??
[ 1175.230730][    T9] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state.
[ 1175.230775][    T9] pctv452e: pctv452e_power_ctrl: 1
[ 1175.230775][    T9] 
[ 1175.230892][    T9] usb 5-1: selecting invalid altsetting 3
[ 1175.230907][    T9] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22
[ 1175.230907][    T9] 
[ 1175.230923][    T9] dvb-usb: bulk message failed: -22 (5/0)
[ 1175.366379][    T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 1175.372272][    T9] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600)
[ 1175.372395][    T9] usb 5-1: media controller created
[ 1175.372447][    T9] dvb-usb: bulk message failed: -22 (8/0)
[ 1175.372463][    T9] pctv452e: I2C error -22; AA 01  A0 01 14 -> aa 01 31 04 a0 01 14
[ 1175.372573][    T9] dvb-usb: MAC address reading failed.
[ 1175.521425][    T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 1175.535718][ T5727] usb 3-1: selecting invalid altsetting 0
[ 1175.575629][ T5727] uvcvideo 3-1:220.0: Found UVC 7.01 device syz (8086:0b07)
[ 1175.575664][ T5727] uvcvideo 3-1:220.0: No valid video chain found.
[ 1175.591851][ T5727] usb 3-1: selecting invalid altsetting 0
[ 1175.591874][ T5727] usbtest 3-1:220.1: probe with driver usbtest failed with error -22
[ 1175.616557][ T5727] usb 3-1: USB disconnect, device number 20
[ 1175.829695][    T9] DVB: Unable to find symbol stb0899_attach()
[ 1175.829712][    T9] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600'
[ 1175.978401][    T9] rc_core: IR keymap rc-tt-1500 not found
[ 1175.978421][    T9] Registered IR keymap rc-empty
[ 1175.980206][    T9] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0
[ 1175.992227][    T9] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input104
[ 1175.998862][    T9] dvb-usb: schedule remote query interval to 100 msecs.
[ 1175.998885][    T9] pctv452e: pctv452e_power_ctrl: 0
[ 1175.998885][    T9] 
[ 1175.998897][    T9] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected.
[ 1176.094926][   T10] usb 2-1: new full-speed USB device number 100 using dummy_hcd
[ 1176.104912][    T9] dvb-usb: bulk message failed: -22 (4/0)
[ 1176.104940][    T9] dvb-usb: error -22 while querying for an remote control event.
[ 1176.214802][ T5727] dvb-usb: bulk message failed: -22 (4/0)
[ 1176.214837][ T5727] dvb-usb: error -22 while querying for an remote control event.
[ 1176.259943][   T10] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[ 1176.262394][   T10] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b
[ 1176.262421][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1176.262441][   T10] usb 2-1: Product: syz
[ 1176.262455][   T10] usb 2-1: Manufacturer: syz
[ 1176.262471][   T10] usb 2-1: SerialNumber: syz
[ 1176.327088][    T9] dvb-usb: bulk message failed: -22 (4/0)
[ 1176.327120][    T9] dvb-usb: error -22 while querying for an remote control event.
[ 1176.352270][   T10] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state
[ 1176.443494][    T9] dvb-usb: bulk message failed: -22 (4/0)
[ 1176.443533][    T9] dvb-usb: error -22 while querying for an remote control event.
[ 1176.527427][    T9] usb 5-1: USB disconnect, device number 12
[ 1177.022630][T15076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1177.023234][T15076] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1177.784572][ T1338] ieee802154 phy0 wpan0: encryption failed: -22
[ 1177.784636][ T1338] ieee802154 phy1 wpan1: encryption failed: -22
[ 1178.407492][    T9] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected.
[ 1178.434516][   T56] hsr_slave_0: left promiscuous mode
[ 1178.543415][   T56] hsr_slave_1: left promiscuous mode
[ 1178.822758][   T56] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 1178.824061][   T56] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 1179.916823][   T10] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter)
[ 1179.936401][   T56] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 1179.936421][   T56] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 1180.002257][   T10] usb 2-1: USB disconnect, device number 100
[ 1180.120310][   T56] veth1_macvtap: left promiscuous mode
[ 1180.120412][   T56] veth0_macvtap: left promiscuous mode
[ 1180.120636][   T56] veth1_vlan: left promiscuous mode
[ 1180.120799][   T56] veth0_vlan: left promiscuous mode
[ 1180.418942][   T10] hid (null): invalid report_count 395657798
[ 1180.418966][   T10] hid (null): unknown global tag 0xc
[ 1180.418980][   T10] hid (null): bogus close delimiter
[ 1180.418993][   T10] hid (null): unknown global tag 0xc
[ 1180.419089][   T10] hid (null): unknown global tag 0xd
[ 1180.419101][   T10] hid (null): unknown global tag 0xbb
[ 1180.419178][   T10] hid (null): unknown global tag 0xe
[ 1180.419202][   T10] hid (null): bogus close delimiter
[ 1180.419224][   T10] hid (null): invalid report_size -2061915488
[ 1180.419247][   T10] hid (null): invalid report_size 23318
[ 1180.419270][   T10] hid (null): unknown global tag 0xc
[ 1180.419303][   T10] hid (null): unknown global tag 0xe
[ 1180.419357][   T10] hid (null): invalid report_size -845816829
[ 1180.419383][   T10] hid (null): invalid report_count 43168
[ 1180.419407][   T10] hid (null): invalid report_count -1269364438
[ 1180.419470][   T10] hid (null): invalid report_count -1623847985
[ 1180.419495][   T10] hid (null): invalid report_size 17710
[ 1180.419508][   T10] hid (null): unknown global tag 0xd
[ 1180.432724][   T10] hid (null): nested delimiters
[ 1180.432795][   T10] hid (null): unknown global tag 0x18
[ 1180.438568][   T10] hid (null): unknown global tag 0xd
[ 1180.438608][   T10] hid (null): unknown global tag 0xd
[ 1180.438621][   T10] hid (null): unknown global tag 0xd
[ 1180.444458][   T10] hid (null): global environment stack underflow
[ 1180.444475][   T10] hid (null): unknown global tag 0xce
[ 1180.444509][   T10] hid (null): unknown global tag 0xe
[ 1180.444522][   T10] hid (null): unknown global tag 0x30
[ 1180.444559][   T10] hid (null): unknown global tag 0xcc
[ 1180.444602][   T10] hid (null): invalid report_size 35267
[ 1180.444656][   T10] hid (null): unknown global tag 0xc
[ 1180.444669][   T10] hid (null): global environment stack underflow
[ 1180.451749][   T10] hid (null): unknown global tag 0xd
[ 1180.451909][   T10] hid (null): unknown global tag 0x91
[ 1180.451956][   T10] hid (null): unknown global tag 0xe
[ 1180.452008][   T10] hid (null): unknown global tag 0xe
[ 1180.452053][   T10] hid (null): unknown global tag 0xd
[ 1180.452067][   T10] hid (null): bogus close delimiter
[ 1180.464881][ T5831] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[ 1180.629680][ T5831] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[ 1180.629708][ T5831] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1180.629728][ T5831] usb 3-1: Product: syz
[ 1180.629742][ T5831] usb 3-1: Manufacturer: syz
[ 1180.629756][ T5831] usb 3-1: SerialNumber: syz
[ 1180.637065][ T5831] usb 3-1: config 0 descriptor??
[ 1180.674898][    T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[ 1180.724248][   T10] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.003A: invalid report_count 395657798
[ 1180.724270][   T10] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.003A: item 0 4 1 9 parsing failed
[ 1180.729664][   T10] hid-generic 7C6B:FFFFFFFD:FFFFFFFD.003A: probe with driver hid-generic failed with error -22
[ 1180.867053][    T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1180.867105][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1180.867183][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1180.867217][    T9] usb 5-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00
[ 1180.867239][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1180.877435][    T9] usb 5-1: config 0 descriptor??
[ 1181.132637][ T5831] usb 3-1: Firmware version (0.0) predates our first public release.
[ 1181.132652][ T5831] usb 3-1: Please update to version 0.2 or newer
[ 1181.291203][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2969'.
[ 1181.505552][   T56] team0 (unregistering): Port device team_slave_1 removed
[ 1181.540448][   T37] audit: type=1804 audit(1780130252.717:502): pid=15127 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.2971" name="bus" dev="ramfs" ino=46810 res=1 errno=0
[ 1181.540485][   T37] audit: type=1804 audit(1780130252.717:503): pid=15127 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.1.2971" name="bus" dev="ramfs" ino=46810 res=1 errno=0
[ 1181.585545][   T56] team0 (unregistering): Port device team_slave_0 removed
[ 1182.234062][    T9] usbhid 5-1:0.0: can't add hid device: -71
[ 1182.234171][    T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[ 1182.260736][    T9] usb 5-1: USB disconnect, device number 13
[ 1182.376946][ T5831] usb 3-1: USB disconnect, device number 21
[ 1183.579141][T14828] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 1183.843543][T14828] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 1183.844187][T15147] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2975'.
[ 1183.880594][T14828] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 1183.928864][T14828] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 1183.929873][T14828] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 1183.992991][T14828] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 1184.002730][T14828] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 1184.103946][T14828] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 1184.175721][   T56] IPVS: stop unused estimator thread 0...
[ 1184.384874][ T5615] usb 4-1: new high-speed USB device number 22 using dummy_hcd
[ 1184.536528][ T5615] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1184.536574][ T5615] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1184.536599][ T5615] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1184.536633][ T5615] usb 4-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00
[ 1184.536654][ T5615] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1184.542929][ T5615] usb 4-1: config 0 descriptor??
[ 1184.623798][T14828] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1184.699777][T14828] 8021q: adding VLAN 0 to HW filter on device team0
[ 1184.734506][T12416] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1184.735348][T12416] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1184.952666][T12414] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1184.953992][T12414] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1184.981229][T15156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2973'.
[ 1185.306191][    T9] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[ 1185.480075][    T9] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[ 1185.480106][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1185.480126][    T9] usb 3-1: Product: syz
[ 1185.480140][    T9] usb 3-1: Manufacturer: syz
[ 1185.480155][    T9] usb 3-1: SerialNumber: syz
[ 1185.523279][    T9] usb 3-1: config 0 descriptor??
[ 1186.162650][    T9] usb 3-1: Firmware version (0.0) predates our first public release.
[ 1186.162678][    T9] usb 3-1: Please update to version 0.2 or newer
[ 1186.294225][    T9] usb 3-1: USB disconnect, device number 22
[ 1186.471714][   T37] audit: type=1804 audit(1780130257.647:504): pid=15193 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.2983" name="bus" dev="ramfs" ino=47877 res=1 errno=0
[ 1186.481736][T13998] usb 5-1: new full-speed USB device number 14 using dummy_hcd
[ 1186.496816][   T37] audit: type=1804 audit(1780130257.667:505): pid=15193 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.1.2983" name="bus" dev="ramfs" ino=47877 res=1 errno=0
[ 1186.714996][T13998] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[ 1186.715025][T13998] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1186.715237][T13998] usb 5-1: Product: syz
[ 1186.715256][T13998] usb 5-1: Manufacturer: syz
[ 1186.715271][T13998] usb 5-1: SerialNumber: syz
[ 1186.763114][T13998] usb 5-1: config 0 descriptor??
[ 1186.785734][T13998] gspca_main: stk1135-2.14.0 probing 174f:6a31
[ 1186.875120][T14828] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1187.109753][ T5615] usbhid 4-1:0.0: can't add hid device: -71
[ 1187.109935][ T5615] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[ 1187.151139][ T5615] usb 4-1: USB disconnect, device number 22
[ 1187.547654][T14828] veth0_vlan: entered promiscuous mode
[ 1187.559660][ T5986] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[ 1187.704810][ T5986] usb 3-1: Using ep0 maxpacket: 16
[ 1187.708336][ T5986] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1187.708369][ T5986] usb 3-1: config 0 interface 0 has no altsetting 0
[ 1187.708454][ T5986] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[ 1187.708478][ T5986] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1187.732473][ T5986] usb 3-1: config 0 descriptor??
[ 1187.901756][T14828] veth1_vlan: entered promiscuous mode
[ 1187.981364][T14828] veth0_macvtap: entered promiscuous mode
[ 1187.996476][T14828] veth1_macvtap: entered promiscuous mode
[ 1188.039629][T14828] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 1188.101230][T14828] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 1188.375710][T15206] QAT: Device 9 not found
[ 1189.125812][ T5986] nzxt-smart2 0003:1E71:2009.003B: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0
[ 1189.196177][T12411] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 1189.196553][T12411] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 1189.196587][T12411] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 1189.196615][T12411] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 1189.805105][T13998] gspca_stk1135: reg_w 0x200 err -110
[ 1189.806147][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806160][T13998] gspca_stk1135: Sensor write failed
[ 1189.806188][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806199][T13998] gspca_stk1135: Sensor write failed
[ 1189.806277][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806288][T13998] gspca_stk1135: Sensor read failed
[ 1189.806315][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806325][T13998] gspca_stk1135: Sensor read failed
[ 1189.806333][T13998] gspca_stk1135: Detected sensor type unknown (0x0)
[ 1189.806364][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806374][T13998] gspca_stk1135: Sensor read failed
[ 1189.806449][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806460][T13998] gspca_stk1135: Sensor read failed
[ 1189.806487][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806497][T13998] gspca_stk1135: Sensor write failed
[ 1189.806524][T13998] gspca_stk1135: serial bus timeout: status=0x00
[ 1189.806682][T13998] gspca_stk1135: Sensor write failed
[ 1189.806824][T13998] stk1135 5-1:0.0: probe with driver stk1135 failed with error -110
[ 1190.035373][ T5747] usb 2-1: new high-speed USB device number 101 using dummy_hcd
[ 1190.283771][ T5747] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1190.283825][ T5747] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1190.283851][ T5747] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1190.283889][ T5747] usb 2-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00
[ 1190.283910][ T5747] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1190.332915][ T5747] usb 2-1: config 0 descriptor??
[ 1190.650855][ T5727] usb 4-1: new high-speed USB device number 23 using dummy_hcd
[ 1190.927035][ T5727] usb 4-1: Using ep0 maxpacket: 32
[ 1190.981945][ T5727] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[ 1190.981974][ T5727] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0
[ 1190.981997][ T5727] usb 4-1: config 0 interface 0 has no altsetting 0
[ 1191.023141][ T5727] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[ 1191.023172][ T5727] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1191.023245][ T5727] usb 4-1: Product: syz
[ 1191.023259][ T5727] usb 4-1: Manufacturer: syz
[ 1191.023272][ T5727] usb 4-1: SerialNumber: syz
[ 1191.262021][ T5727] usb 4-1: config 0 descriptor??
[ 1191.424026][ T5831] usb 3-1: USB disconnect, device number 23
[ 1191.585185][ T2349] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 1191.585205][ T2349] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1191.586135][ T5747] usbhid 2-1:0.0: can't add hid device: -71
[ 1191.586272][ T5747] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[ 1191.692326][ T5727] gs_usb 4-1:0.0: Configuring for 1 interfaces
[ 1191.708754][ T5747] usb 2-1: USB disconnect, device number 101
[ 1191.807234][ T5612] usb 5-1: USB disconnect, device number 14
[ 1192.008207][T12411] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 1192.008226][T12411] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1192.113889][ T5727] gs_usb 4-1:0.0: Couldn't get extended bit timing const for channel 0 (-EPROTO)
[ 1192.114167][ T5727] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -71
[ 1192.213369][ T5727] usb 4-1: USB disconnect, device number 23
[ 1192.757216][ T5831] usb 1-1: new high-speed USB device number 36 using dummy_hcd
[ 1193.619148][ T5831] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1193.619203][ T5831] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[ 1193.619216][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1193.622779][ T5831] usb 1-1: config 0 descriptor??
[ 1193.632950][ T5831] pwc: Askey VC010 type 2 USB webcam detected.
[ 1194.875498][ T5831] pwc: recv_control_msg error -32 req 02 val 2b00
[ 1195.114585][ T5831] pwc: recv_control_msg error -32 req 02 val 2700
[ 1195.127919][ T5831] pwc: recv_control_msg error -32 req 02 val 2c00
[ 1195.134025][ T5831] pwc: recv_control_msg error -32 req 04 val 1000
[ 1195.135777][ T5831] pwc: recv_control_msg error -32 req 04 val 1300
[ 1195.136732][ T5831] pwc: recv_control_msg error -32 req 04 val 1400
[ 1195.137568][ T5831] pwc: recv_control_msg error -32 req 02 val 2000
[ 1195.138271][ T5831] pwc: recv_control_msg error -32 req 02 val 2100
[ 1195.138952][ T5831] pwc: recv_control_msg error -32 req 04 val 1500
[ 1195.139608][ T5831] pwc: recv_control_msg error -32 req 02 val 2500
[ 1195.141557][ T5831] pwc: recv_control_msg error -32 req 02 val 2400
[ 1195.142363][ T5831] pwc: recv_control_msg error -32 req 02 val 2600
[ 1195.351188][ T5831] pwc: recv_control_msg error -71 req 02 val 2800
[ 1195.355064][ T5831] pwc: recv_control_msg error -71 req 04 val 1100
[ 1195.357249][ T5831] pwc: recv_control_msg error -71 req 04 val 1200
[ 1195.448058][ T5831] pwc: Registered as video103.
[ 1195.464555][ T5831] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input105
[ 1195.501114][ T5831] usb 1-1: USB disconnect, device number 36
[ 1195.734793][T15251] hfs: can't find a HFS filesystem on dev nbd3
[ 1196.064810][ T5612] usb 2-1: new high-speed USB device number 102 using dummy_hcd
[ 1196.215000][ T5612] usb 2-1: Using ep0 maxpacket: 16
[ 1196.217937][ T5612] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[ 1196.217963][ T5612] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1196.217982][ T5612] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1196.220211][ T5612] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[ 1196.220239][ T5612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1196.220260][ T5612] usb 2-1: Product: syz
[ 1196.220275][ T5612] usb 2-1: Manufacturer: syz
[ 1196.220290][ T5612] usb 2-1: SerialNumber: syz
[ 1196.311070][ T5612] usb 2-1: 0:2 : does not exist
[ 1196.615884][ T5612] usb 2-1: 1:0: failed to get current value for ch 0 (-22)
[ 1197.627600][ T5612] usb 2-1: USB disconnect, device number 102
[ 1199.618291][T15290] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3010'.
[ 1200.114846][T13998] usb 1-1: new high-speed USB device number 37 using dummy_hcd
[ 1200.449164][T15304] netlink: 260 bytes leftover after parsing attributes in process `syz.4.3015'.
[ 1200.545637][T13998] usb 1-1: Using ep0 maxpacket: 16
[ 1200.595810][T13998] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[ 1200.596929][T13998] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1200.597212][T13998] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1200.698402][T13998] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[ 1200.699283][T13998] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1200.699318][T13998] usb 1-1: Product: syz
[ 1200.700105][T13998] usb 1-1: Manufacturer: syz
[ 1200.700657][T13998] usb 1-1: SerialNumber: syz
[ 1201.833138][T13998] usb 1-1: 0:2 : does not exist
[ 1202.069894][T13998] usb 1-1: 1:0: failed to get current value for ch 0 (-22)
[ 1202.169845][T13998] usb 1-1: USB disconnect, device number 37
[ 1203.168553][T13998] usb 5-1: new full-speed USB device number 15 using dummy_hcd
[ 1204.335207][T15329] FAULT_INJECTION: forcing a failure.
[ 1204.335207][T15329] name failslab, interval 1, probability 0, space 0, times 0
[ 1204.335234][T15329] CPU: 0 UID: 0 PID: 15329 Comm: syz.0.3022 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1204.335259][T15329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1204.335268][T15329] Call Trace:
[ 1204.335274][T15329]  <TASK>
[ 1204.335280][T15329]  dump_stack_lvl+0xe8/0x150
[ 1204.335302][T15329]  should_fail_ex+0x46b/0x600
[ 1204.335327][T15329]  should_failslab+0xa8/0x100
[ 1204.335347][T15329]  __kmalloc_noprof+0xdf/0x7b0
[ 1204.335364][T15329]  ? tomoyo_encode+0x28b/0x550
[ 1204.335386][T15329]  tomoyo_encode+0x28b/0x550
[ 1204.335405][T15329]  tomoyo_realpath_from_path+0x58d/0x5d0
[ 1204.335423][T15329]  ? tomoyo_domain+0xd7/0x130
[ 1204.335445][T15329]  ? tomoyo_path_number_perm+0x219/0x630
[ 1204.335466][T15329]  tomoyo_path_number_perm+0x246/0x630
[ 1204.335490][T15329]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[ 1204.335513][T15329]  ? __lock_acquire+0x6b5/0x2cf0
[ 1204.335538][T15329]  ? do_raw_spin_lock+0x12b/0x2f0
[ 1204.335583][T15329]  ? __fget_files+0x2a/0x420
[ 1204.335603][T15329]  ? __fget_files+0x2a/0x420
[ 1204.335615][T15329]  ? __fget_files+0x3a6/0x420
[ 1204.335627][T15329]  ? __fget_files+0x2a/0x420
[ 1204.335643][T15329]  security_file_ioctl+0xc3/0x2a0
[ 1204.335666][T15329]  __se_sys_ioctl+0x47/0x170
[ 1204.335683][T15329]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1204.335699][T15329]  do_syscall_64+0x174/0x580
[ 1204.335719][T15329]  ? trace_irq_disable+0x3b/0x140
[ 1204.335735][T15329]  ? clear_bhb_loop+0x40/0x90
[ 1204.335752][T15329]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1204.335767][T15329] RIP: 0033:0x7f5ee878ce59
[ 1204.335781][T15329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1204.335794][T15329] RSP: 002b:00007f5ee69c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1204.335810][T15329] RAX: ffffffffffffffda RBX: 00007f5ee8a06090 RCX: 00007f5ee878ce59
[ 1204.335821][T15329] RDX: 0000200000000000 RSI: 00000000c020aa04 RDI: 0000000000000003
[ 1204.335832][T15329] RBP: 00007f5ee69c5090 R08: 0000000000000000 R09: 0000000000000000
[ 1204.335842][T15329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1204.335851][T15329] R13: 00007f5ee8a06128 R14: 00007f5ee8a06090 R15: 00007ffd115cecf8
[ 1204.335875][T15329]  </TASK>
[ 1204.335892][T15329] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1204.886892][ T5727] usb 2-1: new full-speed USB device number 103 using dummy_hcd
[ 1204.996271][T15334] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3024'.
[ 1205.057766][ T5727] usb 2-1: config 0 has an invalid interface number: 106 but max is 0
[ 1205.057794][ T5727] usb 2-1: config 0 has no interface number 0
[ 1205.057837][ T5727] usb 2-1: config 0 interface 106 altsetting 7 has an endpoint descriptor with address 0x95, changing to 0x85
[ 1205.057866][ T5727] usb 2-1: config 0 interface 106 altsetting 7 endpoint 0xA has invalid maxpacket 1023, setting to 64
[ 1205.057891][ T5727] usb 2-1: config 0 interface 106 has no altsetting 0
[ 1205.060637][ T5727] usb 2-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=a3.1e
[ 1205.060655][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1205.060667][ T5727] usb 2-1: Product: syz
[ 1205.060674][ T5727] usb 2-1: Manufacturer: syz
[ 1205.060682][ T5727] usb 2-1: SerialNumber: syz
[ 1205.063620][ T5727] usb 2-1: config 0 descriptor??
[ 1205.064316][T15332] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[ 1205.284761][    C0] usb 2-1: NFC: Urb failure (status -71)
[ 1205.285072][    C0] usb 2-1: NFC: Urb failure (status -71)
[ 1205.297340][ T5727] usb 2-1: NFC: Unable to get FW version
[ 1205.337268][ T5727] pn533_usb 2-1:0.106: probe with driver pn533_usb failed with error -71
[ 1205.440984][ T5727] usb 2-1: USB disconnect, device number 103
[ 1206.005943][ T5612] usb 3-1: new full-speed USB device number 24 using dummy_hcd
[ 1206.152438][T15353] FAULT_INJECTION: forcing a failure.
[ 1206.152438][T15353] name failslab, interval 1, probability 0, space 0, times 0
[ 1206.152461][T15353] CPU: 0 UID: 0 PID: 15353 Comm: syz.1.3029 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1206.152477][T15353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1206.152483][T15353] Call Trace:
[ 1206.152488][T15353]  <TASK>
[ 1206.152493][T15353]  dump_stack_lvl+0xe8/0x150
[ 1206.152517][T15353]  should_fail_ex+0x46b/0x600
[ 1206.152536][T15353]  should_failslab+0xa8/0x100
[ 1206.152550][T15353]  __kmalloc_noprof+0xdf/0x7b0
[ 1206.152564][T15353]  ? security_sk_alloc+0x52/0x360
[ 1206.152582][T15353]  security_sk_alloc+0x52/0x360
[ 1206.152597][T15353]  sk_prot_alloc+0x101/0x210
[ 1206.152610][T15353]  ? sk_alloc+0x27/0x390
[ 1206.152625][T15353]  sk_alloc+0x3a/0x390
[ 1206.152640][T15353]  xsk_create+0x107/0x6b0
[ 1206.152729][T15353]  __sock_create+0x4b2/0x9d0
[ 1206.152746][T15353]  __sys_socket+0xd6/0x1b0
[ 1206.152758][T15353]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1206.152770][T15353]  __x64_sys_socket+0x7a/0x90
[ 1206.152782][T15353]  do_syscall_64+0x174/0x580
[ 1206.152797][T15353]  ? trace_irq_disable+0x3b/0x140
[ 1206.152810][T15353]  ? clear_bhb_loop+0x40/0x90
[ 1206.152823][T15353]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1206.152833][T15353] RIP: 0033:0x7fc5882ece59
[ 1206.152843][T15353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1206.152852][T15353] RSP: 002b:00007fc58653e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
[ 1206.152863][T15353] RAX: ffffffffffffffda RBX: 00007fc588565fa0 RCX: 00007fc5882ece59
[ 1206.152871][T15353] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 000000000000002c
[ 1206.152878][T15353] RBP: 00007fc58653e090 R08: 0000000000000000 R09: 0000000000000000
[ 1206.152884][T15353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1206.152890][T15353] R13: 00007fc588566038 R14: 00007fc588565fa0 R15: 00007ffe26391848
[ 1206.152906][T15353]  </TASK>
[ 1206.383834][ T5612] usb 3-1: config 8 has an invalid interface number: 223 but max is 0
[ 1206.383861][ T5612] usb 3-1: config 8 has an invalid descriptor of length 255, skipping remainder of the config
[ 1206.383882][ T5612] usb 3-1: config 8 has no interface number 0
[ 1206.383942][ T5612] usb 3-1: config 8 interface 223 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[ 1206.554461][ T5612] usb 3-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d
[ 1206.554478][ T5612] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1206.554490][ T5612] usb 3-1: Product: syz
[ 1206.554497][ T5612] usb 3-1: Manufacturer: syz
[ 1206.554520][ T5612] usb 3-1: SerialNumber: syz
[ 1206.687206][T15356] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3031'.
[ 1206.714837][T13998] usb 5-1: new high-speed USB device number 16 using dummy_hcd
[ 1206.865721][T13998] usb 5-1: Using ep0 maxpacket: 16
[ 1206.869880][T13998] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[ 1206.869906][T13998] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1206.869926][T13998] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1206.873314][T13998] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[ 1206.873342][T13998] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1206.873416][T13998] usb 5-1: Product: syz
[ 1206.873431][T13998] usb 5-1: Manufacturer: syz
[ 1206.873447][T13998] usb 5-1: SerialNumber: syz
[ 1207.023420][T13998] usb 5-1: 0:2 : does not exist
[ 1207.051869][ T5612] usb 3-1: USB disconnect, device number 24
[ 1207.089854][T15361] binder: 15357:15361 ioctl c0306201 0 returned -14
[ 1207.674877][T13998] usb 5-1: 1:0: failed to get current value for ch 0 (-22)
[ 1208.052715][T13998] usb 5-1: USB disconnect, device number 16
[ 1208.834846][ T5727] usb 2-1: new full-speed USB device number 104 using dummy_hcd
[ 1209.043243][ T5830] udevd[5830]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 1209.197191][   T59] Bluetooth: hci0: unexpected cc 0x042d length: 63 > 7
[ 1210.385725][T15384] overlayfs: conflicting options: userxattr,redirect_dir=on
[ 1210.704836][ T5747] usb 1-1: new full-speed USB device number 38 using dummy_hcd
[ 1210.738484][   T37] audit: type=1804 audit(1780130281.917:506): pid=15393 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.3042" name="bus" dev="ramfs" ino=48655 res=1 errno=0
[ 1210.783709][   T37] audit: type=1804 audit(1780130281.957:507): pid=15393 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.4.3042" name="bus" dev="ramfs" ino=48655 res=1 errno=0
[ 1210.889432][ T5747] usb 1-1: config 0 has an invalid interface number: 106 but max is 0
[ 1210.889460][ T5747] usb 1-1: config 0 has no interface number 0
[ 1210.889502][ T5747] usb 1-1: config 0 interface 106 altsetting 7 has an endpoint descriptor with address 0x95, changing to 0x85
[ 1210.889529][ T5747] usb 1-1: config 0 interface 106 altsetting 7 endpoint 0xA has invalid maxpacket 1023, setting to 64
[ 1210.889556][ T5747] usb 1-1: config 0 interface 106 has no altsetting 0
[ 1210.892203][ T5747] usb 1-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=a3.1e
[ 1210.892231][ T5747] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1210.892250][ T5747] usb 1-1: Product: syz
[ 1210.892264][ T5747] usb 1-1: Manufacturer: syz
[ 1210.892278][ T5747] usb 1-1: SerialNumber: syz
[ 1210.918689][ T5747] usb 1-1: config 0 descriptor??
[ 1210.944911][ T5727] usb 2-1: new full-speed USB device number 105 using dummy_hcd
[ 1210.947668][T15386] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 1211.011081][T15396] netlink: 'syz.2.3043': attribute type 28 has an invalid length.
[ 1211.011102][T15396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3043'.
[ 1211.126032][ T5727] usb 2-1: config 0 has an invalid interface number: 231 but max is 0
[ 1211.126169][ T5727] usb 2-1: config 0 has no interface number 0
[ 1211.126217][ T5727] usb 2-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64
[ 1211.131162][ T5727] usb 2-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b
[ 1211.131190][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1211.131267][ T5727] usb 2-1: Product: syz
[ 1211.131282][ T5727] usb 2-1: Manufacturer: syz
[ 1211.131296][ T5727] usb 2-1: SerialNumber: syz
[ 1211.179162][ T5727] usb 2-1: config 0 descriptor??
[ 1211.182238][    C0] usb 1-1: NFC: Urb failure (status -71)
[ 1211.183660][T15389] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[ 1211.183806][    C0] usb 1-1: NFC: Urb failure (status -71)
[ 1211.229848][ T5747] usb 1-1: NFC: Unable to get FW version
[ 1211.265817][ T5747] pn533_usb 1-1:0.106: probe with driver pn533_usb failed with error -71
[ 1211.401292][ T5747] usb 1-1: USB disconnect, device number 38
[ 1211.445062][T15389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1211.451715][T15389] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1211.558460][T15397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1211.559074][T15397] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1211.596640][ T5727] plusb 2-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.1-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 3a:df:3d:b0:48:21
[ 1211.619183][ T5727] usb 2-1: USB disconnect, device number 105
[ 1211.635771][ T5727] plusb 2-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.1-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1
[ 1211.968125][T15399] kvm: user requested TSC rate below hardware speed
[ 1212.008866][T15399] FAULT_INJECTION: forcing a failure.
[ 1212.008866][T15399] name failslab, interval 1, probability 0, space 0, times 0
[ 1212.008897][T15399] CPU: 1 UID: 0 PID: 15399 Comm: syz.3.3044 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1212.008919][T15399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1212.008931][T15399] Call Trace:
[ 1212.008950][T15399]  <TASK>
[ 1212.008958][T15399]  dump_stack_lvl+0xe8/0x150
[ 1212.008985][T15399]  should_fail_ex+0x46b/0x600
[ 1212.009028][T15399]  should_failslab+0xa8/0x100
[ 1212.009054][T15399]  __kvmalloc_node_noprof+0x170/0x8e0
[ 1212.009078][T15399]  ? bpf_test_run_xdp_live+0x1f2/0x1cf0
[ 1212.009112][T15399]  bpf_test_run_xdp_live+0x1f2/0x1cf0
[ 1212.009143][T15399]  ? do_raw_spin_lock+0x12b/0x2f0
[ 1212.009180][T15399]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 1212.009208][T15399]  ? lockdep_hardirqs_on+0x7a/0x110
[ 1212.009233][T15399]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 1212.009258][T15399]  ? rt_mutex_slowunlock+0x1cb/0x300
[ 1212.009288][T15399]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 1212.009313][T15399]  ? __pfx_bpf_test_run_xdp_live+0x10/0x10
[ 1212.009359][T15399]  ? 0xffffffffa0201a58
[ 1212.009403][T15399]  ? __pfx_xdp_test_run_init_page+0x10/0x10
[ 1212.009438][T15399]  ? _copy_from_user+0x94/0xb0
[ 1212.009457][T15399]  ? bpf_test_init+0x113/0x150
[ 1212.009479][T15399]  ? xdp_convert_md_to_buff+0x5b/0x330
[ 1212.009506][T15399]  bpf_prog_test_run_xdp+0x81c/0x1160
[ 1212.009546][T15399]  ? __pfx_bpf_prog_test_run_xdp+0x10/0x10
[ 1212.009576][T15399]  ? __fget_files+0x2a/0x420
[ 1212.009599][T15399]  ? __pfx_bpf_prog_test_run_xdp+0x10/0x10
[ 1212.009624][T15399]  bpf_prog_test_run+0x2cd/0x340
[ 1212.009651][T15399]  __sys_bpf+0x643/0x950
[ 1212.009672][T15399]  ? __pfx___sys_bpf+0x10/0x10
[ 1212.009690][T15399]  ? rt_mutex_slowunlock+0x1cb/0x300
[ 1212.009722][T15399]  ? ksys_write+0x248/0x270
[ 1212.009745][T15399]  ? __pfx_ksys_write+0x10/0x10
[ 1212.009770][T15399]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1212.009793][T15399]  __x64_sys_bpf+0x7c/0x90
[ 1212.009813][T15399]  do_syscall_64+0x174/0x580
[ 1212.009837][T15399]  ? trace_irq_disable+0x3b/0x140
[ 1212.009858][T15399]  ? clear_bhb_loop+0x40/0x90
[ 1212.009880][T15399]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1212.009898][T15399] RIP: 0033:0x7f4a9a4dce59
[ 1212.009916][T15399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1212.009931][T15399] RSP: 002b:00007f4a9872e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[ 1212.009958][T15399] RAX: ffffffffffffffda RBX: 00007f4a9a755fa0 RCX: 00007f4a9a4dce59
[ 1212.009972][T15399] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a
[ 1212.009985][T15399] RBP: 00007f4a9872e090 R08: 0000000000000000 R09: 0000000000000000
[ 1212.009997][T15399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1212.010015][T15399] R13: 00007f4a9a756038 R14: 00007f4a9a755fa0 R15: 00007ffcd5f80168
[ 1212.010045][T15399]  </TASK>
[ 1212.444842][ T5727] usb 1-1: new high-speed USB device number 39 using dummy_hcd
[ 1212.707118][ T5831] usb 5-1: new full-speed USB device number 17 using dummy_hcd
[ 1212.730188][ T5727] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[ 1212.730218][ T5727] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1212.730239][ T5727] usb 1-1: Product: syz
[ 1212.730253][ T5727] usb 1-1: Manufacturer: syz
[ 1212.730268][ T5727] usb 1-1: SerialNumber: syz
[ 1212.736022][ T5727] usb 1-1: config 0 descriptor??
[ 1212.867395][ T5831] usb 5-1: config 8 has an invalid interface number: 223 but max is 0
[ 1212.867425][ T5831] usb 5-1: config 8 has an invalid descriptor of length 255, skipping remainder of the config
[ 1212.867436][ T5831] usb 5-1: config 8 has no interface number 0
[ 1212.867461][ T5831] usb 5-1: config 8 interface 223 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[ 1212.869609][ T5831] usb 5-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d
[ 1212.869628][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1212.869639][ T5831] usb 5-1: Product: syz
[ 1212.869646][ T5831] usb 5-1: Manufacturer: syz
[ 1212.869654][ T5831] usb 5-1: SerialNumber: syz
[ 1212.943872][T13998] usb 2-1: new high-speed USB device number 106 using dummy_hcd
[ 1213.104790][T13998] usb 2-1: Using ep0 maxpacket: 16
[ 1213.106521][T13998] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[ 1213.106544][T13998] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1213.106564][T13998] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1213.108800][T13998] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[ 1213.108827][T13998] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1213.108847][T13998] usb 2-1: Product: syz
[ 1213.108862][T13998] usb 2-1: Manufacturer: syz
[ 1213.108876][T13998] usb 2-1: SerialNumber: syz
[ 1213.154813][ T5747] usb 4-1: new high-speed USB device number 24 using dummy_hcd
[ 1213.198396][T13998] usb 2-1: 0:2 : does not exist
[ 1213.199766][ T5831] usb 5-1: USB disconnect, device number 17
[ 1213.215381][   T59] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0
[ 1213.248297][   T59] Bluetooth: hci0: Injecting HCI hardware error event
[ 1213.265591][T14830] Bluetooth: hci0: hardware error 0x00
[ 1213.353365][ T5747] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1213.353419][ T5747] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[ 1213.353998][ T5747] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1213.379424][ T5747] usb 4-1: config 0 descriptor??
[ 1213.412581][ T5747] pwc: Askey VC010 type 2 USB webcam detected.
[ 1213.433843][ T5727] usb 1-1: Firmware version (0.0) predates our first public release.
[ 1213.434784][ T5727] usb 1-1: Please update to version 0.2 or newer
[ 1213.436129][T13998] usb 2-1: 1:0: failed to get current value for ch 0 (-22)
[ 1213.645114][T13998] usb 2-1: USB disconnect, device number 106
[ 1213.805797][ T5747] pwc: recv_control_msg error -32 req 02 val 2b00
[ 1213.806797][ T5747] pwc: recv_control_msg error -32 req 02 val 2700
[ 1213.807374][ T5747] pwc: recv_control_msg error -32 req 02 val 2c00
[ 1213.809796][ T5747] pwc: recv_control_msg error -32 req 04 val 1000
[ 1213.810406][ T5747] pwc: recv_control_msg error -32 req 04 val 1300
[ 1213.810987][ T5747] pwc: recv_control_msg error -32 req 04 val 1400
[ 1213.811547][ T5747] pwc: recv_control_msg error -32 req 02 val 2000
[ 1213.812227][ T5747] pwc: recv_control_msg error -32 req 02 val 2100
[ 1213.813093][ T5747] pwc: recv_control_msg error -32 req 04 val 1500
[ 1213.855448][ T5727] usb 1-1: USB disconnect, device number 39
[ 1213.884910][ T5747] pwc: recv_control_msg error -32 req 02 val 2500
[ 1213.887182][ T5747] pwc: recv_control_msg error -32 req 02 val 2400
[ 1213.888099][ T5747] pwc: recv_control_msg error -32 req 02 val 2600
[ 1214.110694][ T5747] pwc: recv_control_msg error -71 req 02 val 2800
[ 1214.111533][ T5747] pwc: recv_control_msg error -71 req 04 val 1100
[ 1214.112256][ T5747] pwc: recv_control_msg error -71 req 04 val 1200
[ 1214.134788][ T5747] pwc: Registered as video103.
[ 1214.139075][ T5747] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input106
[ 1214.159748][ T5747] usb 4-1: USB disconnect, device number 24
[ 1214.491174][T15421] FAULT_INJECTION: forcing a failure.
[ 1214.491174][T15421] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1214.491206][T15421] CPU: 0 UID: 0 PID: 15421 Comm: syz.0.3051 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1214.491228][T15421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1214.491239][T15421] Call Trace:
[ 1214.491253][T15421]  <TASK>
[ 1214.491261][T15421]  dump_stack_lvl+0xe8/0x150
[ 1214.491288][T15421]  should_fail_ex+0x46b/0x600
[ 1214.491319][T15421]  copy_fpstate_to_sigframe+0xaab/0xd60
[ 1214.491338][T15421]  ? __kasan_slab_free+0x5c/0x80
[ 1214.491424][T15421]  ? kmem_cache_free+0x187/0x6c0
[ 1214.491445][T15421]  ? __dequeue_signal+0x487/0x5b0
[ 1214.491480][T15421]  ? __pfx_copy_fpstate_to_sigframe+0x10/0x10
[ 1214.491521][T15421]  ? fpu__alloc_mathframe+0xac/0x130
[ 1214.491542][T15421]  get_sigframe+0x5f7/0x820
[ 1214.491578][T15421]  ? __pfx_get_sigframe+0x10/0x10
[ 1214.491605][T15421]  ? rt_mutex_slowunlock+0x4a7/0x8b0
[ 1214.491627][T15421]  ? reacquire_held_locks+0x104/0x190
[ 1214.491662][T15421]  x64_setup_rt_frame+0x160/0xcb0
[ 1214.491688][T15421]  ? rt_spin_unlock+0x14f/0x200
[ 1214.491712][T15421]  ? rt_spin_unlock+0x160/0x200
[ 1214.491736][T15421]  ? get_signal+0x114f/0x1330
[ 1214.491761][T15421]  ? __pfx_x64_setup_rt_frame+0x10/0x10
[ 1214.491797][T15421]  arch_do_signal_or_restart+0x442/0x840
[ 1214.491827][T15421]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 1214.491861][T15421]  ? ksys_read+0x248/0x270
[ 1214.491892][T15421]  exit_to_user_mode_loop+0xa9/0x680
[ 1214.492003][T15421]  ? rcu_is_watching+0x15/0xb0
[ 1214.492028][T15421]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1214.492048][T15421]  do_syscall_64+0x353/0x580
[ 1214.492073][T15421]  ? trace_irq_disable+0x3b/0x140
[ 1214.492095][T15421]  ? clear_bhb_loop+0x40/0x90
[ 1214.492118][T15421]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1214.492136][T15421] RIP: 0033:0x7f5ee878ce59
[ 1214.492154][T15421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1214.492170][T15421] RSP: 002b:00007f5ee69e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 1214.492191][T15421] RAX: fffffffffffffffc RBX: 00007f5ee8a05fa0 RCX: 00007f5ee878ce59
[ 1214.492205][T15421] RDX: 00000000000000aa RSI: 0000200000000340 RDI: 0000000000000006
[ 1214.492218][T15421] RBP: 00007f5ee69e6090 R08: 0000000000000000 R09: 0000000000000000
[ 1214.492230][T15421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1214.492264][T15421] R13: 00007f5ee8a06038 R14: 00007f5ee8a05fa0 R15: 00007ffd115cecf8
[ 1214.492294][T15421]  </TASK>
[ 1215.824208][T14830] Bluetooth: hci0: Opcode 0x0c03 failed: -110
[ 1215.948997][   T37] audit: type=1804 audit(1780130287.127:508): pid=15437 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.3056" name="bus" dev="ramfs" ino=49768 res=1 errno=0
[ 1215.951281][   T37] audit: type=1804 audit(1780130287.127:509): pid=15437 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.3056" name="bus" dev="ramfs" ino=49768 res=1 errno=0
[ 1216.202289][T15440] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3057'.
[ 1216.490062][   T37] audit: type=1804 audit(1780130287.667:510): pid=15445 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.3058" name="bus" dev="ramfs" ino=49785 res=1 errno=0
[ 1216.492213][   T37] audit: type=1804 audit(1780130287.667:511): pid=15445 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.4.3058" name="bus" dev="ramfs" ino=49785 res=1 errno=0
[ 1216.537311][   T10] usb 2-1: new full-speed USB device number 107 using dummy_hcd
[ 1216.700581][   T10] usb 2-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1216.700612][   T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1216.739121][   T10] usb 2-1: config 0 descriptor??
[ 1216.759788][   T10] pwc: Samsung MPC-C10 USB webcam detected.
[ 1216.949270][   T10] pwc: send_video_command error -71
[ 1216.949392][   T10] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1216.949595][   T10] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71
[ 1216.981591][   T10] usb 2-1: USB disconnect, device number 107
[ 1217.844911][ T5612] usb 4-1: new high-speed USB device number 25 using dummy_hcd
[ 1217.994786][ T5612] usb 4-1: Using ep0 maxpacket: 16
[ 1217.996876][ T5612] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[ 1217.996901][ T5612] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1217.996928][ T5612] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1218.000076][ T5612] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[ 1218.000103][ T5612] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1218.000125][ T5612] usb 4-1: Product: syz
[ 1218.000139][ T5612] usb 4-1: Manufacturer: syz
[ 1218.000154][ T5612] usb 4-1: SerialNumber: syz
[ 1218.013755][ T5612] usb 4-1: 0:2 : does not exist
[ 1218.857011][ T5612] usb 4-1: 1:0: failed to get current value for ch 0 (-22)
[ 1218.976468][ T5612] usb 4-1: USB disconnect, device number 25
[ 1220.704830][T13998] usb 3-1: new high-speed USB device number 25 using dummy_hcd
[ 1220.857297][T13998] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1220.857353][T13998] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[ 1220.857377][T13998] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1220.911219][T13998] usb 3-1: config 0 descriptor??
[ 1220.932925][T13998] pwc: Askey VC010 type 2 USB webcam detected.
[ 1221.297606][   T37] audit: type=1804 audit(1780130292.477:512): pid=15494 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.3071" name="bus" dev="ramfs" ino=49868 res=1 errno=0
[ 1221.300779][   T37] audit: type=1804 audit(1780130292.477:513): pid=15494 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.3.3071" name="bus" dev="ramfs" ino=49868 res=1 errno=0
[ 1221.340121][T13998] pwc: recv_control_msg error -32 req 02 val 2b00
[ 1221.341029][T13998] pwc: recv_control_msg error -32 req 02 val 2700
[ 1221.362461][T13998] pwc: recv_control_msg error -32 req 02 val 2c00
[ 1221.374730][T13998] pwc: recv_control_msg error -32 req 04 val 1000
[ 1221.377238][T13998] pwc: recv_control_msg error -32 req 04 val 1300
[ 1221.379240][T13998] pwc: recv_control_msg error -32 req 04 val 1400
[ 1221.383838][T13998] pwc: recv_control_msg error -32 req 02 val 2000
[ 1221.415835][T13998] pwc: recv_control_msg error -32 req 02 val 2100
[ 1221.425126][T13998] pwc: recv_control_msg error -32 req 04 val 1500
[ 1221.434355][T13998] pwc: recv_control_msg error -32 req 02 val 2500
[ 1221.470936][T13998] pwc: recv_control_msg error -32 req 02 val 2400
[ 1221.490951][T13998] pwc: recv_control_msg error -32 req 02 val 2600
[ 1221.753531][T13998] pwc: recv_control_msg error -71 req 02 val 2800
[ 1221.754647][T13998] pwc: recv_control_msg error -71 req 04 val 1100
[ 1221.774150][T13998] pwc: recv_control_msg error -71 req 04 val 1200
[ 1221.812102][T13998] pwc: Registered as video103.
[ 1221.868290][T13998] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input107
[ 1221.974902][T13998] usb 3-1: USB disconnect, device number 25
[ 1222.174976][ T5612] usb 1-1: new high-speed USB device number 40 using dummy_hcd
[ 1222.320609][T15503] binder: 15502:15503 ioctl 4008af03 200000001700 returned -22
[ 1222.327281][T15503] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3074'.
[ 1222.341586][ T5612] usb 1-1: Using ep0 maxpacket: 32
[ 1222.343505][ T5612] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[ 1222.343531][ T5612] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0
[ 1222.343550][ T5612] usb 1-1: config 0 interface 0 has no altsetting 0
[ 1222.377863][ T5612] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[ 1222.377892][ T5612] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1222.377913][ T5612] usb 1-1: Product: syz
[ 1222.377927][ T5612] usb 1-1: Manufacturer: syz
[ 1222.377941][ T5612] usb 1-1: SerialNumber: syz
[ 1222.417292][ T5612] usb 1-1: config 0 descriptor??
[ 1222.470167][T15505] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3075'.
[ 1222.555766][T11551] usb 2-1: new full-speed USB device number 108 using dummy_hcd
[ 1222.612515][T15508] kvm: user requested TSC rate below hardware speed
[ 1222.735076][T11551] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[ 1222.735107][T11551] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1222.735180][T11551] usb 2-1: Product: syz
[ 1222.735196][T11551] usb 2-1: Manufacturer: syz
[ 1222.735210][T11551] usb 2-1: SerialNumber: syz
[ 1222.798407][T11551] usb 2-1: config 0 descriptor??
[ 1222.814864][ T5747] usb 4-1: new full-speed USB device number 26 using dummy_hcd
[ 1222.835363][T11551] gspca_main: stk1135-2.14.0 probing 174f:6a31
[ 1222.835685][ T5612] gs_usb 1-1:0.0: Configuring for 1 interfaces
[ 1222.967048][ T5747] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1222.967081][ T5747] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1222.978442][ T5747] usb 4-1: config 0 descriptor??
[ 1223.014061][ T5747] pwc: Samsung MPC-C10 USB webcam detected.
[ 1223.217345][ T5747] pwc: send_video_command error -71
[ 1223.217364][ T5747] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1223.217485][ T5747] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71
[ 1223.232876][ T5747] usb 4-1: USB disconnect, device number 26
[ 1223.256208][ T5612] gs_usb 1-1:0.0: Couldn't get extended bit timing const for channel 0 (-EPROTO)
[ 1223.256658][ T5612] gs_usb 1-1:0.0: probe with driver gs_usb failed with error -71
[ 1223.310627][ T5612] usb 1-1: USB disconnect, device number 40
[ 1224.165131][T11551] gspca_stk1135: reg_w 0x7 err -110
[ 1224.166175][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166188][T11551] gspca_stk1135: Sensor write failed
[ 1224.166216][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166227][T11551] gspca_stk1135: Sensor write failed
[ 1224.166255][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166330][T11551] gspca_stk1135: Sensor read failed
[ 1224.166357][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166368][T11551] gspca_stk1135: Sensor read failed
[ 1224.166376][T11551] gspca_stk1135: Detected sensor type unknown (0x0)
[ 1224.166408][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166417][T11551] gspca_stk1135: Sensor read failed
[ 1224.166443][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166454][T11551] gspca_stk1135: Sensor read failed
[ 1224.166568][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166580][T11551] gspca_stk1135: Sensor write failed
[ 1224.166607][T11551] gspca_stk1135: serial bus timeout: status=0x00
[ 1224.166617][T11551] gspca_stk1135: Sensor write failed
[ 1224.166715][T11551] stk1135 2-1:0.0: probe with driver stk1135 failed with error -110
[ 1224.451256][T15522] FAULT_INJECTION: forcing a failure.
[ 1224.451256][T15522] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1224.451278][T15522] CPU: 1 UID: 0 PID: 15522 Comm: syz.3.3082 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1224.451291][T15522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1224.451297][T15522] Call Trace:
[ 1224.451301][T15522]  <TASK>
[ 1224.451307][T15522]  dump_stack_lvl+0xe8/0x150
[ 1224.451324][T15522]  should_fail_ex+0x46b/0x600
[ 1224.451343][T15522]  _copy_from_user+0x2d/0xb0
[ 1224.451354][T15522]  get_timespec64+0x96/0x1b0
[ 1224.451450][T15522]  ? __pfx_get_timespec64+0x10/0x10
[ 1224.451463][T15522]  ? rt_mutex_slowunlock+0x1cb/0x300
[ 1224.451477][T15522]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 1224.451492][T15522]  __se_sys_pselect6+0x13a/0x320
[ 1224.451512][T15522]  ? __pfx___se_sys_pselect6+0x10/0x10
[ 1224.451526][T15522]  ? __pfx_ksys_write+0x10/0x10
[ 1224.451547][T15522]  ? __x64_sys_pselect6+0x21/0xf0
[ 1224.451562][T15522]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1224.451573][T15522]  do_syscall_64+0x174/0x580
[ 1224.451588][T15522]  ? trace_irq_disable+0x3b/0x140
[ 1224.451601][T15522]  ? clear_bhb_loop+0x40/0x90
[ 1224.451613][T15522]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1224.451624][T15522] RIP: 0033:0x7f4a9a4dce59
[ 1224.451635][T15522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1224.451644][T15522] RSP: 002b:00007f4a9872e028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[ 1224.451656][T15522] RAX: ffffffffffffffda RBX: 00007f4a9a755fa0 RCX: 00007f4a9a4dce59
[ 1224.451664][T15522] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040
[ 1224.451671][T15522] RBP: 00007f4a9872e090 R08: 0000200000000280 R09: 0000000000000000
[ 1224.451678][T15522] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001
[ 1224.451684][T15522] R13: 00007f4a9a756038 R14: 00007f4a9a755fa0 R15: 00007ffcd5f80168
[ 1224.451700][T15522]  </TASK>
[ 1224.604821][ T5747] usb 3-1: new high-speed USB device number 26 using dummy_hcd
[ 1224.757163][ T5747] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1224.757196][ T5747] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1224.757211][ T5747] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1224.757232][ T5747] usb 3-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00
[ 1224.757245][ T5747] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1224.760595][ T5747] usb 3-1: config 0 descriptor??
[ 1224.884955][ T5727] usb 1-1: new low-speed USB device number 41 using dummy_hcd
[ 1224.916077][T15531] comedi: No check for data length of config insn id 5 is implemented
[ 1224.916089][T15531] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c
[ 1224.916129][T15531] comedi: Assuming n=37496 is correct
[ 1224.954824][T13998] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[ 1225.014889][ T5727] usb 1-1: device descriptor read/64, error -71
[ 1225.104795][T13998] usb 5-1: Using ep0 maxpacket: 8
[ 1225.111421][T13998] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64
[ 1225.111449][T13998] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1225.111469][T13998] usb 5-1: Product: syz
[ 1225.111491][T13998] usb 5-1: Manufacturer: syz
[ 1225.111505][T13998] usb 5-1: SerialNumber: syz
[ 1225.147198][   T37] audit: type=1804 audit(1780130296.327:514): pid=15534 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.3086" name="bus" dev="ramfs" ino=49023 res=1 errno=0
[ 1225.151784][   T37] audit: type=1804 audit(1780130296.327:515): pid=15534 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.3.3086" name="bus" dev="ramfs" ino=49023 res=1 errno=0
[ 1225.178011][T15520] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3081'.
[ 1225.191350][ T5747] usbhid 3-1:0.0: can't add hid device: -71
[ 1225.191464][ T5747] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[ 1225.217339][T13998] usb 5-1: config 0 descriptor??
[ 1225.218798][ T5747] usb 3-1: USB disconnect, device number 26
[ 1225.249483][T13998] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state.
[ 1225.249526][T13998] pctv452e: pctv452e_power_ctrl: 1
[ 1225.249526][T13998] 
[ 1225.249570][T13998] usb 5-1: selecting invalid altsetting 3
[ 1225.249585][T13998] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22
[ 1225.249585][T13998] 
[ 1225.249601][T13998] dvb-usb: bulk message failed: -22 (5/0)
[ 1225.264815][ T5727] usb 1-1: new low-speed USB device number 42 using dummy_hcd
[ 1225.347195][T13998] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 1225.347937][T13998] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600)
[ 1225.348110][T13998] usb 5-1: media controller created
[ 1225.348160][T13998] dvb-usb: bulk message failed: -22 (8/0)
[ 1225.348175][T13998] pctv452e: I2C error -22; AA 01  A0 01 14 -> aa 01 31 04 a0 01 14
[ 1225.348225][T13998] dvb-usb: MAC address reading failed.
[ 1225.394844][ T5727] usb 1-1: device descriptor read/64, error -71
[ 1225.418408][T13998] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 1225.505366][ T5727] usb usb1-port1: attempt power cycle
[ 1225.513574][T13998] DVB: Unable to find symbol stb0899_attach()
[ 1225.513589][T13998] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600'
[ 1225.609478][T13998] rc_core: IR keymap rc-tt-1500 not found
[ 1225.609500][T13998] Registered IR keymap rc-empty
[ 1225.651985][T13998] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0
[ 1225.653125][ T5747] usb 2-1: USB disconnect, device number 108
[ 1225.686113][T13998] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input108
[ 1225.726223][T13998] dvb-usb: schedule remote query interval to 100 msecs.
[ 1225.726245][T13998] pctv452e: pctv452e_power_ctrl: 0
[ 1225.726245][T13998] 
[ 1225.726257][T13998] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected.
[ 1225.779467][T13998] usb 5-1: USB disconnect, device number 18
[ 1225.848490][ T5727] usb 1-1: new low-speed USB device number 43 using dummy_hcd
[ 1225.865904][ T5727] usb 1-1: device descriptor read/8, error -71
[ 1226.101912][T13998] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected.
[ 1226.104901][ T5727] usb 1-1: new low-speed USB device number 44 using dummy_hcd
[ 1226.125525][ T5727] usb 1-1: device descriptor read/8, error -71
[ 1226.275327][ T5747] usb 2-1: new high-speed USB device number 109 using dummy_hcd
[ 1226.298835][ T5727] usb usb1-port1: unable to enumerate USB device
[ 1226.431423][ T5747] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1226.431479][ T5747] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[ 1226.431503][ T5747] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1226.439997][ T5747] usb 2-1: config 0 descriptor??
[ 1226.446399][ T5747] pwc: Askey VC010 type 2 USB webcam detected.
[ 1226.644818][T13998] usb 5-1: new high-speed USB device number 19 using dummy_hcd
[ 1226.805117][T13998] usb 5-1: Using ep0 maxpacket: 8
[ 1226.808035][T13998] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1226.808076][T13998] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1226.808127][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1226.808156][T13998] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1226.808183][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1226.808205][T13998] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1226.808222][T13998] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1226.808236][T13998] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1226.809638][T13998] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1226.809675][T13998] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1226.809714][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1226.809741][T13998] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1226.809767][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1226.809788][T13998] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1226.809809][T13998] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1226.809835][T13998] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1226.812741][T13998] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1226.812779][T13998] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1226.812818][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1226.812845][T13998] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1226.812871][T13998] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1226.812893][T13998] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1226.812917][T13998] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1226.812944][T13998] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1226.815989][T13998] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[ 1226.816016][T13998] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1226.816035][T13998] usb 5-1: Product: syz
[ 1226.816050][T13998] usb 5-1: Manufacturer: syz
[ 1226.816064][T13998] usb 5-1: SerialNumber: syz
[ 1226.862470][T15555] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3092'.
[ 1226.917087][ T5747] pwc: recv_control_msg error -32 req 02 val 2b00
[ 1226.917896][ T5747] pwc: recv_control_msg error -32 req 02 val 2700
[ 1226.918580][ T5747] pwc: recv_control_msg error -32 req 02 val 2c00
[ 1226.919277][ T5747] pwc: recv_control_msg error -32 req 04 val 1000
[ 1226.919968][ T5747] pwc: recv_control_msg error -32 req 04 val 1300
[ 1226.920653][ T5747] pwc: recv_control_msg error -32 req 04 val 1400
[ 1226.921324][ T5747] pwc: recv_control_msg error -32 req 02 val 2000
[ 1226.922407][ T5747] pwc: recv_control_msg error -32 req 02 val 2100
[ 1226.923213][ T5747] pwc: recv_control_msg error -32 req 04 val 1500
[ 1226.924129][ T5747] pwc: recv_control_msg error -32 req 02 val 2500
[ 1226.926111][ T5747] pwc: recv_control_msg error -32 req 02 val 2400
[ 1226.926786][ T5747] pwc: recv_control_msg error -32 req 02 val 2600
[ 1227.147573][ T5747] pwc: recv_control_msg error -71 req 02 val 2800
[ 1227.148417][ T5747] pwc: recv_control_msg error -71 req 04 val 1100
[ 1227.150582][ T5747] pwc: recv_control_msg error -71 req 04 val 1200
[ 1227.177672][ T5747] pwc: Registered as video103.
[ 1227.199997][ T5747] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input109
[ 1227.205010][   T10] usb 4-1: new full-speed USB device number 27 using dummy_hcd
[ 1227.227888][ T5747] usb 2-1: USB disconnect, device number 109
[ 1227.590393][   T10] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1227.590425][   T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1227.618866][   T10] usb 4-1: config 0 descriptor??
[ 1227.645182][   T10] pwc: Samsung MPC-C10 USB webcam detected.
[ 1227.856421][   T10] pwc: send_video_command error -71
[ 1227.856439][   T10] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1227.856558][   T10] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71
[ 1227.875949][   T10] usb 4-1: USB disconnect, device number 27
[ 1230.556068][T15578] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
[ 1231.258533][T15592] Illegal XDP return value 4294967274 on prog  (id 360) dev N/A, expect packet loss!
[ 1231.566258][   T37] audit: type=1804 audit(1780130302.747:516): pid=15598 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.3101" name="bus" dev="ramfs" ino=49119 res=1 errno=0
[ 1231.566309][   T37] audit: type=1804 audit(1780130302.747:517): pid=15598 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.1.3101" name="bus" dev="ramfs" ino=49119 res=1 errno=0
[ 1231.705372][T13998] adutux 5-1:168.0: interrupt endpoints not found
[ 1231.714104][T13998] usb 5-1: USB disconnect, device number 19
[ 1233.032045][ T5986] usb 4-1: new full-speed USB device number 28 using dummy_hcd
[ 1233.797128][ T5986] usb 4-1: config 0 has an invalid interface number: 106 but max is 0
[ 1233.797156][ T5986] usb 4-1: config 0 has no interface number 0
[ 1233.797189][ T5986] usb 4-1: config 0 interface 106 altsetting 7 has an endpoint descriptor with address 0x95, changing to 0x85
[ 1233.797205][ T5986] usb 4-1: config 0 interface 106 altsetting 7 endpoint 0xA has invalid maxpacket 1023, setting to 64
[ 1233.797220][ T5986] usb 4-1: config 0 interface 106 has no altsetting 0
[ 1233.799466][ T5986] usb 4-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=a3.1e
[ 1233.799502][ T5986] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1233.799517][ T5986] usb 4-1: Product: syz
[ 1233.799525][ T5986] usb 4-1: Manufacturer: syz
[ 1233.799533][ T5986] usb 4-1: SerialNumber: syz
[ 1233.881569][ T5986] usb 4-1: config 0 descriptor??
[ 1233.882449][T15607] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[ 1234.195206][    C1] usb 4-1: NFC: Urb failure (status -71)
[ 1234.196882][    C1] usb 4-1: NFC: Urb failure (status -71)
[ 1234.208402][T15618] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3108'.
[ 1234.224787][ T5986] usb 4-1: NFC: Unable to get FW version
[ 1234.240118][ T5986] pn533_usb 4-1:0.106: probe with driver pn533_usb failed with error -71
[ 1234.264079][ T5986] usb 4-1: USB disconnect, device number 28
[ 1234.615687][T13998] usb 1-1: new full-speed USB device number 45 using dummy_hcd
[ 1234.708840][T11551] usb 2-1: new low-speed USB device number 110 using dummy_hcd
[ 1234.779229][T13998] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1234.779260][T13998] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1234.809291][T13998] usb 1-1: config 0 descriptor??
[ 1234.827835][T13998] pwc: Samsung MPC-C10 USB webcam detected.
[ 1234.867851][T11551] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1234.867915][T11551] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[ 1234.868018][T11551] usb 2-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47
[ 1234.868042][T11551] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1234.927754][T11551] usb 2-1: config 0 descriptor??
[ 1234.946607][T11551] qmi_wwan 2-1:0.0: skipping garbage
[ 1234.947116][T11551] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22
[ 1235.004815][   T10] usb 3-1: new low-speed USB device number 27 using dummy_hcd
[ 1235.022779][T13998] pwc: send_video_command error -71
[ 1235.022795][T13998] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1235.022911][T13998] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71
[ 1235.047947][T13998] usb 1-1: USB disconnect, device number 45
[ 1235.133352][T15626] FAULT_INJECTION: forcing a failure.
[ 1235.133352][T15626] name failslab, interval 1, probability 0, space 0, times 0
[ 1235.133386][T15626] CPU: 1 UID: 0 PID: 15626 Comm: syz.1.3109 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1235.133409][T15626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1235.133420][T15626] Call Trace:
[ 1235.133428][T15626]  <TASK>
[ 1235.133437][T15626]  dump_stack_lvl+0xe8/0x150
[ 1235.133465][T15626]  should_fail_ex+0x46b/0x600
[ 1235.133498][T15626]  should_failslab+0xa8/0x100
[ 1235.133524][T15626]  __kmalloc_noprof+0xdf/0x7b0
[ 1235.133546][T15626]  ? kfree+0x4d/0x6c0
[ 1235.133564][T15626]  ? tomoyo_realpath_from_path+0xe3/0x5d0
[ 1235.133593][T15626]  tomoyo_realpath_from_path+0xe3/0x5d0
[ 1235.133617][T15626]  ? tomoyo_domain+0xd7/0x130
[ 1235.133645][T15626]  ? tomoyo_path_number_perm+0x219/0x630
[ 1235.133672][T15626]  tomoyo_path_number_perm+0x246/0x630
[ 1235.133703][T15626]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[ 1235.133728][T15626]  ? __lock_acquire+0x6b5/0x2cf0
[ 1235.133756][T15626]  ? do_raw_spin_lock+0x12b/0x2f0
[ 1235.133809][T15626]  ? __fget_files+0x2a/0x420
[ 1235.133831][T15626]  ? __fget_files+0x2a/0x420
[ 1235.133848][T15626]  ? __fget_files+0x3a6/0x420
[ 1235.133868][T15626]  ? __fget_files+0x2a/0x420
[ 1235.133891][T15626]  security_file_ioctl+0xc3/0x2a0
[ 1235.133926][T15626]  __se_sys_ioctl+0x47/0x170
[ 1235.133949][T15626]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1235.133971][T15626]  do_syscall_64+0x174/0x580
[ 1235.133997][T15626]  ? trace_irq_disable+0x3b/0x140
[ 1235.134019][T15626]  ? clear_bhb_loop+0x40/0x90
[ 1235.134043][T15626]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1235.134062][T15626] RIP: 0033:0x7fc5882ece59
[ 1235.134080][T15626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1235.134097][T15626] RSP: 002b:00007fc58651d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1235.134117][T15626] RAX: ffffffffffffffda RBX: 00007fc588566090 RCX: 00007fc5882ece59
[ 1235.134131][T15626] RDX: 0000200000000380 RSI: 00000000c0d05605 RDI: 0000000000000006
[ 1235.134145][T15626] RBP: 00007fc58651d090 R08: 0000000000000000 R09: 0000000000000000
[ 1235.134158][T15626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1235.134169][T15626] R13: 00007fc588566128 R14: 00007fc588566090 R15: 00007ffe26391848
[ 1235.134201][T15626]  </TASK>
[ 1235.172982][   T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1235.173031][   T10] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[ 1235.173072][   T10] usb 3-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47
[ 1235.173095][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1235.201782][   T10] usb 3-1: config 0 descriptor??
[ 1235.215201][   T10] qmi_wwan 3-1:0.0: skipping garbage
[ 1235.215452][   T10] qmi_wwan 3-1:0.0: probe with driver qmi_wwan failed with error -22
[ 1235.288072][T15626] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1235.738477][T13998] usb 3-1: USB disconnect, device number 27
[ 1235.935222][T15635] overlayfs: missing 'lowerdir'
[ 1236.077602][  T822] usb 2-1: USB disconnect, device number 110
[ 1236.134812][   T10] usb 4-1: new high-speed USB device number 29 using dummy_hcd
[ 1236.284846][   T10] usb 4-1: Using ep0 maxpacket: 16
[ 1236.290099][   T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1236.290124][   T10] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 2
[ 1236.595422][  T822] usb 1-1: new full-speed USB device number 46 using dummy_hcd
[ 1236.654915][ T5727] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[ 1236.722772][   T37] audit: type=1804 audit(1780130307.897:518): pid=15641 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.3116" name="bus" dev="ramfs" ino=50283 res=1 errno=0
[ 1236.747788][  T822] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1236.752538][  T822] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1
[ 1236.752566][  T822] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3
[ 1236.752968][  T822] usb 1-1: Product: syz
[ 1236.752985][  T822] usb 1-1: Manufacturer: syz
[ 1236.752999][  T822] usb 1-1: SerialNumber: syz
[ 1236.754101][   T37] audit: type=1804 audit(1780130307.927:519): pid=15641 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.3116" name="bus" dev="ramfs" ino=50283 res=1 errno=0
[ 1236.790838][  T822] usb 1-1: config 0 descriptor??
[ 1236.804986][ T5727] usb 5-1: Using ep0 maxpacket: 8
[ 1236.833828][  T822] imon_raw 1-1:0.0: IR endpoint missing
[ 1236.834221][ T5727] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1236.834243][ T5727] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1236.834265][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1236.834284][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1236.834424][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1236.834438][ T5727] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1236.834451][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1236.834466][ T5727] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1236.857236][ T5727] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1236.857288][ T5727] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1236.857389][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1236.857417][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1236.857442][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1236.857464][ T5727] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1236.857535][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1236.857562][ T5727] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1236.894969][ T5727] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1236.895060][ T5727] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1236.895100][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1236.895126][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1236.895207][ T5727] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1236.895230][ T5727] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1236.895254][ T5727] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1236.895282][ T5727] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1236.986806][ T5727] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[ 1236.986836][ T5727] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1236.986905][ T5727] usb 5-1: Product: syz
[ 1236.986920][ T5727] usb 5-1: Manufacturer: syz
[ 1236.986934][ T5727] usb 5-1: SerialNumber: syz
[ 1237.300205][ T5612] usb 1-1: USB disconnect, device number 46
[ 1238.492475][   T10] usb 4-1: string descriptor 0 read error: -71
[ 1238.492641][   T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[ 1238.492662][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1238.523662][   T10] usb 4-1: rejected 1 configuration due to insufficient available bus power
[ 1238.523678][   T10] usb 4-1: no configuration chosen from 1 choice
[ 1238.562710][   T10] usb 4-1: USB disconnect, device number 29
[ 1238.652138][ T1338] ieee802154 phy0 wpan0: encryption failed: -22
[ 1238.652207][ T1338] ieee802154 phy1 wpan1: encryption failed: -22
[ 1238.757323][T15650] overlayfs: missing 'lowerdir'
[ 1239.005846][ T5612] hid (null): unknown global tag 0xd
[ 1239.005909][ T5612] hid (null): unknown global tag 0xfe
[ 1239.005934][ T5612] hid (null): unknown global tag 0xc
[ 1239.005947][ T5612] hid (null): unknown global tag 0xe
[ 1239.027660][ T5612] hid-generic 0005:01FF:0070.003C: unknown global tag 0xd
[ 1239.027674][ T5612] hid-generic 0005:01FF:0070.003C: item 0 4 1 13 parsing failed
[ 1239.052544][ T5612] hid-generic 0005:01FF:0070.003C: probe with driver hid-generic failed with error -22
[ 1239.333146][T15662] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3123'.
[ 1239.506950][ T5727] adutux 5-1:168.0: interrupt endpoints not found
[ 1239.528360][ T5727] usb 5-1: USB disconnect, device number 20
[ 1239.753830][T11551] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[ 1239.829679][ T5612] usb 2-1: new full-speed USB device number 111 using dummy_hcd
[ 1240.132937][T11551] usb 3-1: Using ep0 maxpacket: 8
[ 1240.144120][T11551] usb 3-1: config 0 has an invalid interface number: 255 but max is 0
[ 1240.144145][T11551] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1240.144165][T11551] usb 3-1: config 0 has no interface number 0
[ 1240.144196][T11551] usb 3-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30
[ 1240.144234][T11551] usb 3-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255
[ 1240.144262][T11551] usb 3-1: config 0 interface 255 has no altsetting 0
[ 1240.947051][ T5612] usb 2-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44
[ 1240.947081][ T5612] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1240.952605][T11551] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e
[ 1240.952632][T11551] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1240.952652][T11551] usb 3-1: Product: syz
[ 1240.952665][T11551] usb 3-1: Manufacturer: syz
[ 1240.952678][T11551] usb 3-1: SerialNumber: syz
[ 1241.005050][ T5612] usb 2-1: config 0 descriptor??
[ 1241.031133][T11551] usb 3-1: config 0 descriptor??
[ 1241.044832][ T5612] pwc: Samsung MPC-C10 USB webcam detected.
[ 1241.052267][T11551] streamzap 3-1:0.255: streamzap_probe: Unexpected desc.bNumEndpoints (0)
[ 1241.458181][ T5612] pwc: send_video_command error -71
[ 1241.458200][ T5612] pwc: Failed to set video mode VGA@30 fps; return code = -71
[ 1241.458309][ T5612] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71
[ 1241.463566][ T5612] usb 2-1: USB disconnect, device number 111
[ 1241.692202][T15677] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3124'.
[ 1242.653603][ T5986] usb 5-1: new high-speed USB device number 21 using dummy_hcd
[ 1242.710308][T15684] netlink: 260 bytes leftover after parsing attributes in process `syz.3.3128'.
[ 1242.828535][ T5986] usb 5-1: Using ep0 maxpacket: 8
[ 1242.867044][ T5986] usb 5-1: too many configurations: 9, using maximum allowed: 8
[ 1243.544715][ T5986] usb 5-1: unable to read config index 0 descriptor/start: -61
[ 1243.544751][ T5986] usb 5-1: can't read configurations, error -61
[ 1243.577050][   T10] usb 3-1: USB disconnect, device number 28
[ 1243.754842][ T5986] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[ 1243.904844][ T5986] usb 5-1: Using ep0 maxpacket: 8
[ 1243.905790][ T5986] usb 5-1: too many configurations: 9, using maximum allowed: 8
[ 1243.907678][ T5986] usb 5-1: unable to read config index 0 descriptor/start: -61
[ 1243.907710][ T5986] usb 5-1: can't read configurations, error -61
[ 1243.908263][ T5986] usb usb5-port1: attempt power cycle
[ 1243.947319][T15688] iommufd_mock iommufd_mock0: Adding to iommu group 0
[ 1244.029637][   T37] audit: type=1804 audit(1780130315.207:520): pid=15690 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.3130" name="bus" dev="ramfs" ino=51243 res=1 errno=0
[ 1244.030354][   T37] audit: type=1804 audit(1780130315.207:521): pid=15690 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.3130" name="bus" dev="ramfs" ino=51243 res=1 errno=0
[ 1244.455252][ T5986] usb 5-1: new high-speed USB device number 23 using dummy_hcd
[ 1244.517044][ T5986] usb 5-1: Using ep0 maxpacket: 8
[ 1244.517750][ T5986] usb 5-1: too many configurations: 9, using maximum allowed: 8
[ 1244.532708][ T5986] usb 5-1: unable to read config index 0 descriptor/start: -61
[ 1244.532745][ T5986] usb 5-1: can't read configurations, error -61
[ 1244.976652][ T5986] usb 5-1: new high-speed USB device number 24 using dummy_hcd
[ 1245.039846][ T5986] usb 5-1: Using ep0 maxpacket: 8
[ 1245.044020][ T5986] usb 5-1: too many configurations: 9, using maximum allowed: 8
[ 1245.050780][ T5986] usb 5-1: unable to read config index 0 descriptor/start: -61
[ 1245.050816][ T5986] usb 5-1: can't read configurations, error -61
[ 1245.055270][ T5986] usb usb5-port1: unable to enumerate USB device
[ 1245.413583][T15701] FAULT_INJECTION: forcing a failure.
[ 1245.413583][T15701] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1245.413616][T15701] CPU: 1 UID: 0 PID: 15701 Comm: syz.3.3133 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1245.413638][T15701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1245.413649][T15701] Call Trace:
[ 1245.413657][T15701]  <TASK>
[ 1245.413665][T15701]  dump_stack_lvl+0xe8/0x150
[ 1245.413693][T15701]  should_fail_ex+0x46b/0x600
[ 1245.413726][T15701]  _copy_to_user+0x31/0xb0
[ 1245.413747][T15701]  simple_read_from_buffer+0xe1/0x170
[ 1245.413781][T15701]  proc_fail_nth_read+0x1be/0x230
[ 1245.413805][T15701]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 1245.413829][T15701]  ? rw_verify_area+0x2ac/0x4e0
[ 1245.413850][T15701]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 1245.413871][T15701]  vfs_read+0x212/0xa80
[ 1245.413899][T15701]  ? __pfx_vfs_read+0x10/0x10
[ 1245.413922][T15701]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 1245.413950][T15701]  ? lockdep_hardirqs_on+0x7a/0x110
[ 1245.413976][T15701]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 1245.414000][T15701]  ? mutex_lock_nested+0x152/0x1d0
[ 1245.414018][T15701]  ? fdget_pos+0x252/0x320
[ 1245.414042][T15701]  ksys_read+0x156/0x270
[ 1245.414064][T15701]  ? __pfx_ksys_read+0x10/0x10
[ 1245.414093][T15701]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1245.414112][T15701]  do_syscall_64+0x174/0x580
[ 1245.414136][T15701]  ? trace_irq_disable+0x3b/0x140
[ 1245.414158][T15701]  ? clear_bhb_loop+0x40/0x90
[ 1245.414179][T15701]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1245.414198][T15701] RIP: 0033:0x7f4a9a49d68e
[ 1245.414216][T15701] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 1245.414233][T15701] RSP: 002b:00007f4a9872dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 1245.414253][T15701] RAX: ffffffffffffffda RBX: 00007f4a9872e6c0 RCX: 00007f4a9a49d68e
[ 1245.414267][T15701] RDX: 000000000000000f RSI: 00007f4a9872e0a0 RDI: 0000000000000003
[ 1245.414279][T15701] RBP: 00007f4a9872e090 R08: 0000000000000000 R09: 0000000000000000
[ 1245.414291][T15701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1245.414303][T15701] R13: 00007f4a9a756038 R14: 00007f4a9a755fa0 R15: 00007ffcd5f80168
[ 1245.414336][T15701]  </TASK>
[ 1245.659193][T15702] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3134'.
[ 1245.933571][T12411] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1246.084976][ T5831] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[ 1246.234782][ T5831] usb 5-1: Using ep0 maxpacket: 8
[ 1246.238094][ T5831] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1246.238134][ T5831] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1246.238174][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1246.238202][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1246.238227][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1246.238250][ T5831] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1246.238274][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1246.238302][ T5831] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1246.239354][ T5831] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1246.239389][ T5831] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1246.239428][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1246.239456][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1246.239482][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1246.239502][ T5831] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1246.239526][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1246.239552][ T5831] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1246.241916][ T5831] usb 5-1: config 168 descriptor has 1 excess byte, ignoring
[ 1246.241952][ T5831] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[ 1246.242000][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[ 1246.242029][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0x98, changing to 0x88
[ 1246.242044][ T5831] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x88 has invalid wMaxPacketSize 0
[ 1246.242056][ T5831] usb 5-1: config 168 interface 0 altsetting 188 bulk endpoint 0x88 has invalid maxpacket 0
[ 1246.242068][ T5831] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[ 1246.242082][ T5831] usb 5-1: config 168 interface 0 has no altsetting 0
[ 1246.257740][ T5831] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[ 1246.257771][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1246.257791][ T5831] usb 5-1: Product: syz
[ 1246.257805][ T5831] usb 5-1: Manufacturer: syz
[ 1246.257820][ T5831] usb 5-1: SerialNumber: syz
[ 1247.662495][T12411] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 1247.763744][T15717] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3139'.
[ 1248.075705][ T5612] usb 4-1: new full-speed USB device number 30 using dummy_hcd
[ 1248.293283][   T10] BUG: unable to handle page fault for address: ffffc90021b11010
[ 1248.293303][   T10] #PF: supervisor read access in kernel mode
[ 1248.293313][   T10] #PF: error_code(0x0000) - not-present page
[ 1248.293323][   T10] PGD 13fe30067 P4D 13fe30067 PUD 1aee3067 PMD 72950067 PTE 0
[ 1248.293355][   T10] Oops: Oops: 0000 [#1] SMP KASAN PTI
[ 1248.293375][   T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[ 1248.293411][   T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 1248.293431][   T10] Workqueue: usb_hub_wq hub_event
[ 1248.293580][   T10] RIP: 0010:kcov_remote_start+0x2a1/0x710
[ 1248.293601][   T10] Code: 8a 8d 4c 8b b8 08 34 6a 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 20 56 02 8e 4d 8b 3f 49 81 ff 20 56 02 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 91 63 e7 02 84 c0 74 0e 49 8b 07 49
[ 1248.293615][   T10] RSP: 0018:ffffc900000f77c8 EFLAGS: 00010283
[ 1248.293629][   T10] RAX: 0000000000000000 RBX: ffff88801cebbd80 RCX: 0000000000000000
[ 1248.293641][   T10] RDX: 0000000012c2f200 RSI: 0000000000000001 RDI: ffffffff8ba75980
[ 1248.293652][   T10] RBP: 0000000000100000 R08: ffffffff8b1dbac0 R09: ffffffff8dfc80c0
[ 1248.293664][   T10] R10: dffffc0000000000 R11: fffffbfff1f10b5f R12: 0000000000000002
[ 1248.293675][   T10] R13: 0000000000000001 R14: ffff8880344fdf00 R15: ffffc90021b11000
[ 1248.293687][   T10] FS:  0000000000000000(0000) GS:ffff888126186000(0000) knlGS:0000000000000000
[ 1248.293700][   T10] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1248.293713][   T10] CR2: ffffc90021b11010 CR3: 000000004f214000 CR4: 00000000003526f0
[ 1248.293728][   T10] Call Trace:
[ 1248.293734][   T10]  <TASK>
[ 1248.293744][   T10]  hub_event+0x150/0x4f60
[ 1248.293769][   T10]  ? __lock_acquire+0x6b5/0x2cf0
[ 1248.293789][   T10]  ? look_up_lock_class+0x57/0x110
[ 1248.293815][   T10]  ? __lock_acquire+0x6b5/0x2cf0
[ 1248.293835][   T10]  ? srcu_invoke_callbacks+0x2bd/0x5a0
[ 1248.293860][   T10]  ? lock_acquire+0x106/0x350
[ 1248.293879][   T10]  ? __pfx_do_raw_spin_lock+0x10/0x10
[ 1248.293897][   T10]  ? __pfx_hub_event+0x10/0x10
[ 1248.293917][   T10]  ? process_scheduled_works+0xa70/0x1860
[ 1248.293938][   T10]  ? process_scheduled_works+0xa70/0x1860
[ 1248.293953][   T10]  ? process_scheduled_works+0xa70/0x1860
[ 1248.293970][   T10]  process_scheduled_works+0xb5d/0x1860
[ 1248.293997][   T10]  ? __pfx_process_scheduled_works+0x10/0x10
[ 1248.294016][   T10]  ? assign_work+0x3d5/0x5e0
[ 1248.294033][   T10]  worker_thread+0xa53/0xfc0
[ 1248.294059][   T10]  kthread+0x388/0x470
[ 1248.294078][   T10]  ? __pfx_worker_thread+0x10/0x10
[ 1248.294094][   T10]  ? __pfx_kthread+0x10/0x10
[ 1248.294113][   T10]  ret_from_fork+0x514/0xb70
[ 1248.294132][   T10]  ? __pfx_ret_from_fork+0x10/0x10
[ 1248.294155][   T10]  ? __switch_to+0xc79/0x1410
[ 1248.294178][   T10]  ? __pfx_kthread+0x10/0x10
[ 1248.294198][   T10]  ret_from_fork_asm+0x1a/0x30
[ 1248.294223][   T10]  </TASK>
[ 1248.294234][   T10] Modules linked in:
[ 1248.294251][   T10] CR2: ffffc90021b11010
[ 1248.294266][   T10] ---[ end trace 0000000000000000 ]---
[ 1248.294277][   T10] RIP: 0010:kcov_remote_start+0x2a1/0x710
[ 1248.294295][   T10] Code: 8a 8d 4c 8b b8 08 34 6a 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 20 56 02 8e 4d 8b 3f 49 81 ff 20 56 02 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 91 63 e7 02 84 c0 74 0e 49 8b 07 49
[ 1248.294308][   T10] RSP: 0018:ffffc900000f77c8 EFLAGS: 00010283
[ 1248.294321][   T10] RAX: 0000000000000000 RBX: ffff88801cebbd80 RCX: 0000000000000000
[ 1248.294332][   T10] RDX: 0000000012c2f200 RSI: 0000000000000001 RDI: ffffffff8ba75980
[ 1248.294343][   T10] RBP: 0000000000100000 R08: ffffffff8b1dbac0 R09: ffffffff8dfc80c0
[ 1248.294355][   T10] R10: dffffc0000000000 R11: fffffbfff1f10b5f R12: 0000000000000002
[ 1248.294367][   T10] R13: 0000000000000001 R14: ffff8880344fdf00 R15: ffffc90021b11000
[ 1248.294379][   T10] FS:  0000000000000000(0000) GS:ffff888126186000(0000) knlGS:0000000000000000
[ 1248.294392][   T10] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1248.294403][   T10] CR2: ffffc90021b11010 CR3: 000000004f214000 CR4: 00000000003526f0
[ 1248.294422][   T10] Kernel panic - not syncing: Fatal exception
[ 1248.294687][   T10] Kernel Offset: disabled