last executing test programs: 7m14.972064313s ago: executing program 0 (id=8): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)={0x9000000c}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000000)={0xa0000001}) epoll_pwait(r2, &(0x7f0000000600)=[{}], 0x1, 0x1ff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket(0x10, 0x800, 0x0) getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r4, 0x3) r5 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x8500) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r8 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0xa, 0x20002f7}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x28}}, 0x0) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r5, 0xc018643a, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x41e, [{{0x9, 0x2, 0x48}}]}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 7m11.400525668s ago: executing program 0 (id=15): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="91100400000000009500000000000000ab89becd60798ba0c7b340b02956c1c3822c3f572da76a3b992d243e0b89f6b734d5fdf6cb7955ac9702e4a18821040f9856a1bf21bf5e9b77a91e739c3ee223bb727fb18bc991da02854893b585f4465da763f2ac1d5e22ab728ef23681fe8fdf16f570082bdfadcd7f48aa86c2c12a78db90a7781fa547451f272ad46f8e5733fb606f040417634328cbf1b47957851ce3cbc4eb683cc45e48df30ead552a32564e7d1ab13b4aa22e4dd4970134ec08873d32468bed08369a2ec7cef09ea5af2dfc3dbf2f13954a41a3e02b5e2fd65c37b0f22ce8f18ef"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) pipe2$watch_queue(0x0, 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$evdev(0x0, 0x2, 0x862b01) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000003c0)={0x54, 0x0, 0x0, {0xffff, 0x1}, {0x50, 0x2}, @cond=[{0x8, 0x5388, 0x8, 0x800, 0xcb, 0x7}, {0x0, 0x5, 0x1, 0x3, 0x6}]}) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) setrlimit(0x8, &(0x7f0000000300)={0x4, 0x7}) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r2, 0x0, 0x2c, 0x24044000, &(0x7f0000000380)={0x2, 0x4e22, @remote}, 0x10) r4 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x2d, 0x2, 0x0) shmctl$IPC_RMID(r4, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') preadv(r6, &(0x7f0000000640)=[{&(0x7f0000000140)=""/134, 0x86}], 0x1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r6, 0xc0105303, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r5, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000400)={&(0x7f0000000680)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002cbd7000fddbdf257900000008000300", @ANYRES32=0x0, @ANYBLOB="3dc43cdc2f5604c50400f4000400f4000400f4000400f4000500f400203ff3cd658590b45883c6c6f124d02da58ea4fea0bf6d41c13d157f726d3d1031158768ebafc3ebc263f18b7f0aa7e48f8f051c4032477074f8ccafd1d11df4cdd88967fbd0bb86ef6056fe5cec47e51d16b8ec24dedd17b4556ab5eb83241f8e6b2a66e3561145240f45752385a15b960e378e51e59505e0f1012933e738187d81d35b5e56eeb3793f5028d39171b2f1794bf3f619fba2d3bbc23b4f1715d5ad335dfef226f874744862c82e2a3c5ce16af50ffd17dae5d96e6141c6436cd7576248b9b44e6ece74e13c7cb64c8b80ba80c64685c85d375abc000000000000000000000000062c7d98c27bd186359c415577fde00300e93b7982e34f60b60e70f2626ab166f84a6da7"], 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x48000) ioctl$AUTOFS_IOC_FAIL(r7, 0x4c80, 0xffffffffffffffb6) 7m8.772928632s ago: executing program 0 (id=21): ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xd}}, './file0\x00'}) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_STATFS(r0, &(0x7f0000002080)={0x60, 0x0, r1, {{0x9, 0x0, 0x1000, 0x7, 0x5, 0x4, 0x9, 0x2}}}, 0x60) (async, rerun: 32) r3 = fcntl$dupfd(r0, 0x406, r0) (async, rerun: 32) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002100), 0x2, 0x0) write$FUSE_BMAP(r4, &(0x7f0000002140)={0x18, 0xfffffffffffffffe, r1, {0x10}}, 0x18) (async) setsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, &(0x7f0000002180)="363db5ceb1a67cd475d0131bede3cbf0cfbeca32fc84b597e55cacd57ca75ca88b6d1d967930867406448dffc0dec91afbc0dd82b926c74d4a4ae9561ce0ad478cd1cd8a6173f36ea29fe0fbeea9ebfc561f2e7b1b7afe9d4ca7ce0abb0d8538e19e9ad29dfbae215f21dedfc7", 0x6d) setsockopt$inet6_group_source_req(r3, 0x29, 0x70, &(0x7f0000002200)={0x6, {{0xa, 0x4e20, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x431}}, {{0xa, 0x4e20, 0x6, @loopback, 0x8}}}, 0x108) (async) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000002340), 0x80, 0x0) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000002380)={{0x12, 0x1, 0x751, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x10, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x2, 0x0, 0x3, "", [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x2, 0x2, {0x9, 0x21, 0xbc, 0x7f, 0x1, {0x22, 0xb97}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0xab, 0xe7, 0x8}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x5, 0xb2, 0xff}}]}}}]}}]}}, &(0x7f00000028c0)={0xa, &(0x7f00000023c0)={0xa, 0x6, 0x310, 0x1c, 0x40, 0xbf, 0x10, 0xf}, 0x83, &(0x7f0000002400)={0x5, 0xf, 0x83, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x8, 0x4, 0x1}, @generic={0x60, 0x10, 0x2, "543aff2ec17cbe880d4db0383e0124a9b523df8c8010964407f217d2f228e674e02aae8b76ef0fc6c26fe6ca97e463b833e799cbd9447c21232c09150c5c213242b2eaaf9f463c1e3c72d4481c3e44db39c56430ba01df570066cc6c50"}, @ssp_cap={0x14, 0x10, 0xa, 0x8, 0x2, 0x8, 0xf, 0x7, [0xc030, 0xc0]}, @ptm_cap={0x3}]}, 0x9, [{0x4, &(0x7f00000024c0)=@lang_id={0x4, 0x3, 0x419}}, {0x60, &(0x7f0000002500)=@string={0x60, 0x3, "d28c7498a7549f6fd904fad44c1a8b8186022136cbe39e23c954602976efe1c1cdd5fef3be4d2940fb65d73ca8c6f267ecffa8f6b5cb58c03f64705b7f1a570d2cb4484af576fbb1968ef6bfb42322524942fec0e864917bf6dda7e955d7"}}, {0x9c, &(0x7f0000002580)=@string={0x9c, 0x3, "4271ac7e6a74ee7661598471d0c5198043f187a7fdcc38cc0d462e4ed3109e2058d783006b5fd8b7f465b5f837a91b3fdd41ffa085fa7302bb61689cbaebee682263f574723744d79c61016ae57436473f4e3b0f8df9517e45dde8a650df80aa5be48cc5a44387730fe3bfde4040e67985c53316142c285773323182b6066195c647c5ea5c216e3eaf6dac4a97775f48bf2053bb2e7fd4795042"}}, {0x4, &(0x7f0000002640)=@lang_id={0x4, 0x3, 0x380a}}, {0xe0, &(0x7f0000002680)=@string={0xe0, 0x3, "83c3c7f268bd75f2aa31ab74883298100a35d0e949b9ef5c1d12e61bb943eb27898995c9ad5681e249a54437133f4cec56e60d2e0ad315486133a079bf7edb5caf82e6778c1b30a02201cc3ba313e8d96ef77f1759f56185fe10d72943837de65f8e60d69c6d6842b99c9e8cf55ee4a66e95f63f74f30636673e05f18ec6cb0e5bf736c589ebd51f8f10fb19ce835573de56da7c800fa3b65824d39e614c36814d62a9cf93273bf17201ed6d743fada005ed034b67ecb98b813f7cfd8c4b815fcbf61626a8748936ce3a710cd63a888e6527b6b20627b4c7a43351aa0523"}}, {0x7e, &(0x7f0000002780)=@string={0x7e, 0x3, "c86719bf947d60139f2ed843926bb983b9a6b9a9a2faa9d0f2016b9d10eb248a790dd23c007bb8197633af69cc35503018ba3bbcb361a6a1c81cffacd66a3b75224c58541c60417cfed05338dc02891586b07fed8efade8c9a443d98b0152b7de7f86444f9dddc718bba39bae73cc631df491990c84777a03b14a70d"}}, {0x36, &(0x7f0000002800)=@string={0x36, 0x3, "9d5b169750e1affaf298e3a65c4e6f21a3716b5c0007c5df885a35204f34875e2b739bfdec3396c630f237268d754f43f23e3420"}}, {0x4, &(0x7f0000002840)=@lang_id={0x4, 0x3, 0x861}}, {0x4, &(0x7f0000002880)=@lang_id={0x4, 0x3, 0x406}}]}) (async, rerun: 64) ioctl$FE_DISEQC_SEND_MASTER_CMD(r0, 0x40076f3f, &(0x7f0000002980)={"c1eb087d631f", 0x6}) (rerun: 64) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) mlock(&(0x7f0000ffa000/0x3000)=nil, 0x3000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8982, &(0x7f00000029c0)={0x6, 'ip6_vti0\x00', {0xb}, 0x8000}) (async) preadv(r0, &(0x7f0000006d00)=[{&(0x7f0000002a00)=""/164, 0xa4}, {&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f0000003ac0)=""/4096, 0x1000}, {&(0x7f0000004ac0)=""/85, 0x55}, {&(0x7f0000004b40)=""/248, 0xf8}, {&(0x7f0000004c40)=""/133, 0x85}, {&(0x7f0000004d00)=""/4096, 0x1000}, {&(0x7f0000005d00)=""/4096, 0x1000}], 0x8, 0xae, 0xa) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000006d80)={0x0, 0xf0ae}, &(0x7f0000006dc0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000006e00)={0x7, 0x8001, 0x200, 0xa0, 0x10001, 0x5, 0x2, 0x5, r6}, 0x20) (async) r7 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000006e80), 0x12000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000006ec0)={&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000006e40)="e041afc09836e80ca719d22227480d7576e6f9d2112653ae36fb762d2a2dc11902", 0x21, r7}, 0x68) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000006f40)={r6, 0x1}, &(0x7f0000006f80)=0x8) (async) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r4) syz_usb_connect$cdc_ncm(0x5, 0x7e, &(0x7f0000006fc0)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6c, 0x2, 0x1, 0x40, 0x10, 0x8, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "a066a835990d"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x7, 0xbca, 0x7}, {0x6, 0x24, 0x1a, 0xe, 0x20}, [@obex={0x5, 0x24, 0x15, 0x2}, @obex={0x5}]}, {{0x9, 0x5, 0x81, 0x3, 0x450, 0x3, 0x6c, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x1, 0x7, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x408, 0x1, 0x0, 0xf}}}}}}}]}}, &(0x7f0000007100)={0xa, &(0x7f0000007040)={0xa, 0x6, 0x200, 0xd7, 0x9, 0x4, 0xff, 0x8}, 0x5, &(0x7f0000007080)={0x5, 0xf, 0x5}, 0x1, [{0x37, &(0x7f00000070c0)=@string={0x37, 0x3, "6877bb60e9d51eb10d082c7a2bffb61a67dad649d24cfb5c620b63777c6c2cd67517fcd099ebb5c075e76dab14613dc3ac7c930d41"}}]}) (async) syz_mount_image$fuse(&(0x7f0000007140), &(0x7f0000007180)='./file0\x00', 0x200030, &(0x7f00000071c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@default_permissions}, {}, {@blksize={'blksize', 0x3d, 0x1000}}, {@blksize}, {@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x7ff}}, {@blksize={'blksize', 0x3d, 0x400}}, {@max_read={'max_read', 0x3d, 0xff}}], [{@measure}, {@uid_eq={'uid', 0x3d, r2}}, {@fowner_lt={'fowner<', r2}}, {@subj_user={'subj_user', 0x3d, '%4$0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYRES8=r1, @ANYRESDEC], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x24, 0x24, 0x2, 0x70bd26, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x7}, {0xfff4, 0xffff}, {0x5, 0x7ff9}}}, 0x24}, 0x1, 0x0, 0x0, 0x2004855}, 0x841) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r6, 0x25, &(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004540000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000028000380180000800c00018006000100d103000008000340000000010c00008008000340000000022c0000000e0a010200000000000000000a0000000900020073797a31000000000900010073797a31"], 0xec}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r6, 0x4068aea3, &(0x7f0000000340)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000240)="440f21bbc4e11f2ac8410f01c4b8010000000f01c1c4e2f9210966420f388059fbc74424003c010000c7442402e6dd0000ff2c240f01cf6566470f388150f066b83d018ed0", 0x45}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0, 0x64}], 0x1, 0x1d, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x28, 0x0, 0x2, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7, 0x1e}}}}}, 0x28}, 0x1, 0x0, 0x0, 0xc800}, 0x40800) 7m7.411845465s ago: executing program 0 (id=29): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000800000008"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r0, &(0x7f0000000040), 0x0}, 0x20) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, &(0x7f0000048000), 0x1) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000)=0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)=@newqdisc={0x24, 0x24, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0xffff, 0xfff9}, {0x5, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000700)=0xe) sendfile(r1, r2, 0x0, 0x10ffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000001c0)="2e00000010008188040f46ecdb4cb9cca7480ef40f000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x336, 0x0, 0x0, 0xc9e}, 0x600) 7m6.925883671s ago: executing program 32 (id=29): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000800000008"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r0, &(0x7f0000000040), 0x0}, 0x20) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, &(0x7f0000048000), 0x1) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000)=0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)=@newqdisc={0x24, 0x24, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0xffff, 0xfff9}, {0x5, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000700)=0xe) sendfile(r1, r2, 0x0, 0x10ffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000001c0)="2e00000010008188040f46ecdb4cb9cca7480ef40f000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x336, 0x0, 0x0, 0xc9e}, 0x600) 9.520282772s ago: executing program 3 (id=1920): r0 = inotify_init() r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x20400}, 0xc) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, r2, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0x4000423) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000000), 0x560c89bb) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x20) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) 8.844488007s ago: executing program 3 (id=1924): openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) accept(r0, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x80) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f00000001c0)={0x28, 0x6, r4, 0x0, &(0x7f0000000280), 0x0, 0x4}) ioctl$IOMMU_IOAS_UNMAP(r3, 0x3b86, &(0x7f0000000240)={0x18, r4, 0x9, 0x100000001}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000340)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x34014c40, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r5, &(0x7f0000008340)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x6, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r7, r5) ioctl$FS_IOC_ENABLE_VERITY(r5, 0x40806685, &(0x7f0000000200)={0x1, 0x4, 0x1000, 0x0, &(0x7f0000000000), 0x2, 0x0, &(0x7f0000000d40)="d0f9"}) 7.250108503s ago: executing program 5 (id=1932): unshare(0x60000600) r0 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e00)={0x84, &(0x7f0000000840)={0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)={0x40, 0x21, 0x1, 0x4}}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x234a047, 0x0, 0x10, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000002100210100000000010000000a00000200000001000000001400110067656e65766531000000000000000000"], 0x30}}, 0x0) 6.289513826s ago: executing program 1 (id=1938): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xc1b}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r3, 0x40505331, &(0x7f0000000100)={{0x5, 0x9}, {0x0, 0x6}, 0x4, 0x4, 0x7}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x6, 0x400000000000e, 0x4, 0x4, 0xc, 0x1000, 0xf1, 0x8, 0x7fffffffffffb, 0x5, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x8000000, 0x3c4210}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000040)={0x10201, 0x80, 0xc0, &(0x7f0000000340)=[0x5, 0x7ffffc, 0xe, 0x80, 0xe6b4, 0x101, 0xfffffffffffffffa, 0x5, 0x8, 0x2, 0x2, 0x700000000000000, 0x9, 0xffff, 0xfffffffffffffffe, 0x7, 0x7fffffff, 0x5, 0x28, 0x9880, 0x5, 0x6c51, 0x8, 0x2, 0x4, 0x20000000009, 0x10, 0x1fd, 0x8, 0x0, 0x7, 0x9, 0x5, 0x2, 0x501, 0x40, 0xfffffffffffffff5, 0x4, 0x100, 0x7d, 0x0, 0x6, 0x20008, 0x2e2, 0x101, 0x6, 0x0, 0xfffffffdfffffff9, 0x4100000000, 0xfffffffffffffffd, 0x8, 0x9, 0x7fff, 0xec, 0x8000000000000000, 0x4, 0x952, 0x7, 0x7fffffffffffffff, 0x6, 0xffffffffffffffff, 0xd, 0x11, 0x3, 0x5, 0x7, 0x1, 0x2000000000000007, 0x7fffffffffffffff, 0x38c, 0x7, 0x7, 0xae8c, 0x100001e30fa4c, 0xa, 0x0, 0x4000007, 0xdac, 0xe94, 0x7, 0xfffffffffffffffc, 0xa7, 0xba00, 0x4, 0x9, 0x0, 0x1, 0x100, 0x3, 0xe, 0xfffffffffffffff9, 0x3, 0x5, 0x21, 0xfffffffffffffc01, 0xfffffffffffffffd, 0xc01, 0x3, 0x1e4b, 0x2, 0x79, 0xf, 0x10000, 0xe, 0x6, 0x3, 0x20000000000003, 0xfffffffffffffff9, 0x0, 0x4, 0xa, 0x40000001, 0x9, 0x0, 0xfff, 0x80, 0x3, 0xd, 0x4, 0x9, 0xffff, 0x1, 0x401, 0x1000, 0x2, 0x1, 0xea7, 0x1]}) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x408d6}, 0x24000010) 5.632327456s ago: executing program 3 (id=1939): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) symlink(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000000)='./file0\x00') socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x800, 0x0, 0x1, 0x1}, 0x20) landlock_create_ruleset(&(0x7f0000000040)={0xc, 0x0, 0x2}, 0x18, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x59}]}, &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000280)="aa", 0x1, 0x0, 0x0, 0x0) r4 = fcntl$dupfd(r0, 0x0, r1) accept4$inet6(r4, 0x0, 0x0, 0x800) 5.533513667s ago: executing program 5 (id=1940): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') pwritev(r0, &(0x7f0000000880)=[{&(0x7f00000002c0)='2', 0x1}], 0x1, 0x0, 0x0) (async) pwritev(r0, &(0x7f0000000880)=[{&(0x7f00000002c0)='2', 0x1}], 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="e50000000000000071100a0000000000e5000000000000009500000000000000"], &(0x7f0000000240)='syzkaller\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, r0, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 5.331779354s ago: executing program 4 (id=1941): r0 = getpid() prlimit64(r0, 0xd, &(0x7f0000000080)={0x796, 0xee0000}, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x50, 0x3c5b, 0x1, 0x24, 0xd, 0x2, 0x4, 0xffffffff, 0xe661, 0x0, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x243, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0x40], [0x8, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x4b, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x7ff, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x3, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x89, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000001340)="0e9849f1332c3a4f7cd80c990e6bb6b5979749a4fbaef24bc5bcc03ac73ad01da6441277f5ac3b4d0ab075522859b01dff8f24e16cd420439da93470adbb7411843f018e01848aec434d0395f241ae92"}) ioctl$BINDER_THREAD_EXIT(r5, 0x40046208, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/tty/drivers\x00', 0x0, 0x0) 5.244247644s ago: executing program 5 (id=1942): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x26e1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x1, 0x0, 0x0) (async) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x1, 0x0, 0x0) close(0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$procfs(0xffffff9c, &(0x7f0000000640)='/proc/key-users\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000680)={0x2020}, 0x2020) (async) read$FUSE(r2, &(0x7f0000000680)={0x2020}, 0x2020) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000002c0)={@cgroup=r2, 0x2, 0x0, 0x7, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000180)=[0x0, 0x0], &(0x7f00000001c0)=[0x0], &(0x7f0000000240)}, 0x40) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000002c0)={@cgroup=r2, 0x2, 0x0, 0x7, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000180)=[0x0, 0x0], &(0x7f00000001c0)=[0x0], &(0x7f0000000240)}, 0x40) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r4, 0x4) (async) listen(r4, 0x4) close_range(r3, r4, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000380), 0x800000003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000540)={0x18000000, 0x1, 0x4, 0x0, 0xad}) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f00000003c0)={0x1, @pix_mp={0xffffffff, 0x7fff, 0x34324152, 0x5, 0x2, [{0x7, 0x3}, {0x8, 0x4000000}, {0x8, 0x21}, {0xc91, 0x80000000}, {0x6, 0x9}, {0x4, 0x1000c}, {0x802, 0x2}, {0xfffffffe}], 0xb, 0x5, 0x8, 0x2, 0x5}}) 4.910235683s ago: executing program 1 (id=1944): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c000200080001ea02"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x4c, 0x10, 0x403, 0x300, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0xffe}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x4c}}, 0x8000) 4.854972724s ago: executing program 4 (id=1945): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac000000002000", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 4.552156598s ago: executing program 3 (id=1946): mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYRES8=r0], 0x7c}}, 0x8041) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101804bc9555e1affd5020000000900010001797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000000009000300737975320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x24040010}, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000280)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) bpf$MAP_CREATE(0x2000000000000015, &(0x7f0000000140), 0x48) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000000)=[r2, r2, r2, r2], 0x4, 0x80000}) socket$nl_netfilter(0x10, 0x3, 0xc) mq_open(&(0x7f00000002c0)='.\\\x00\xd5\xf6\t\xcf\xc4Q\xdfx\x8e2\xd4\xe9\xb5\xf5w\x9bP\xbf\xe7\x87\xf0\xe5.\xe7\xa0\x8e\xcd\xe1\x8a3\xbbh5SA,\xd3\xec\",p\x81W\xa8\x83\xec\n\xeb\x1c@\xa3!\x03\n%J\x92\xa7\xe9\xb2\x9c\xee\x9b\xb8+\xd88\xddw\x97\'\xc5\xads`^\xb7I\\\xcf\xe5\x98\xe4gY\xa9\xf0\x9f\xfe\xe2\x9a~\xd9\xa1\xe4P*U\x91\x1f\'\xa9OE\xb4F\xdfd\xac\\S\xb2\xc0\xc1\xc9M\xfc\x8c\x1d,\xdc\x03\x1d\xdb\xa2N\xd8\xd7\xed\x8b\\T\x01\x80\xff\xffp\x8d}\x17\xe4?\x96H\x8c\x0fA\xfc]?\xa0I\x82}\xd9\xd6\xd4\xd8\x84l3#z\xb7<\x0fLB\xcav&UX\xb2H\x84\xd2\x9fy\xe0\xb1\x19\xd24\xf1\xb3\x81\xf7\xfb\xddO\xe2H\x13\x02\xf9}\xd9y=\xa3\xf8`[\xbb\x16h\xd1\xcb\xcazl\xa8\xc8\x88\xf5:\x18\x00\x19\x00\x00\x00\x00', 0x2, 0x1e8, 0x0) 4.33594965s ago: executing program 1 (id=1948): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000800)={0x0, {0xfffffff9, 0x0, 0x8, 0x3, 0x3, 0xbb}}) write$uinput_user_dev(r0, &(0x7f0000000240)={'syz0\x00', {0x9, 0x1, 0x2, 0x3}, 0x2, [0x5, 0x5, 0x81, 0x8, 0x4, 0x1000, 0x50000, 0x1, 0x10001, 0xffffa103, 0x3, 0x6, 0x6, 0x6, 0x7, 0x3, 0x6, 0x0, 0x40, 0x5, 0x1cac, 0x3eb, 0xb8f, 0x3, 0x400, 0x40, 0x6, 0x0, 0xfffffffa, 0xdc, 0xffffffff, 0xa1bc, 0x200, 0x7, 0x6, 0x6, 0x3, 0x1, 0x0, 0x0, 0x2, 0x400, 0x7a08, 0x200, 0x3, 0x6, 0x7ff, 0x7f, 0x1c, 0x7, 0xe, 0x9, 0x5, 0xa, 0x3, 0x2, 0xf7, 0xfff, 0x71, 0x5, 0x1ac0, 0x4f, 0x6, 0x8], [0x5, 0x3ff, 0x6, 0xea, 0x3, 0x0, 0xca, 0x1c5936c5, 0x9, 0xfffffff8, 0x4, 0x1, 0x7, 0x6, 0xa, 0x4, 0x2, 0x0, 0x5, 0x2, 0x0, 0x6, 0x0, 0x1, 0x9, 0x6, 0x5e5893ee, 0xfffffff7, 0x9, 0x10000, 0x3, 0x8001, 0x2e6d, 0x7ff, 0x1, 0x9000, 0x877, 0x9, 0x8, 0x8, 0x80000000, 0xfff, 0x5, 0x7, 0x8, 0x5, 0x75da, 0x2, 0x5, 0xe8, 0x3, 0x9, 0x5, 0x7, 0xb99c, 0x2, 0x1000001, 0x4, 0x4, 0x1, 0x1, 0x9, 0x2, 0xc406], [0x80000001, 0x2, 0x9, 0x9, 0x0, 0xb9, 0x897, 0x5, 0x3, 0x4, 0x2, 0x5, 0x3, 0x9, 0x9, 0x7, 0x9, 0x61, 0x9, 0x5, 0x9, 0x8, 0x2, 0x6, 0x8001, 0x4, 0xc, 0x80000000, 0x7fffffff, 0x1, 0x1, 0x6, 0x8, 0x3, 0x2, 0x5, 0x3, 0x2, 0x1, 0x24, 0x9, 0x2000000, 0x4, 0xff, 0x7, 0x3eef6cc9, 0x1, 0x7, 0x7, 0x8bd, 0x9, 0xfffffff9, 0x80000001, 0x5, 0xffffff1d, 0x6, 0x0, 0xa, 0xfff, 0xfff, 0x1, 0x1, 0x19ee, 0xfffffff9], [0x0, 0x10, 0x101, 0x2, 0x4, 0x9c500, 0xef, 0x8, 0xc61, 0x7, 0x1d, 0x358, 0xd567, 0x1d5, 0xc8b, 0x658, 0xcbfd, 0x101, 0x6, 0x5, 0xb, 0x5, 0x6, 0x3, 0x75d6, 0xb26, 0x3ff, 0x6, 0x9, 0x0, 0x1, 0xf412, 0x2, 0x2, 0x2000002, 0x3, 0x3, 0x9, 0x3, 0x5, 0x3, 0x3, 0xfffffff3, 0x8000, 0x6, 0x6, 0xffff, 0x80, 0xf, 0xfff, 0xfff, 0xffff, 0xfffffffe, 0x80, 0xb975, 0x5, 0x5e1, 0xa, 0xffff58ee, 0x2, 0x2530, 0x4, 0x26da282, 0xc]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000d80)={'syz0\x00', {0xb, 0x3, 0x4, 0x9}, 0x3, [0x3ffffff8, 0x0, 0x0, 0x3, 0xf, 0x0, 0x7ff, 0xa, 0x5, 0x3, 0x5, 0x40, 0x1, 0x1, 0x7, 0x6, 0x0, 0x7, 0x1, 0xdef, 0x9, 0x7, 0x200, 0x5, 0x73c, 0x5, 0x4, 0x7f, 0x4, 0x6, 0xfffffff9, 0x8, 0x6, 0x4, 0x7, 0x7, 0x1939, 0x8, 0x7, 0x2, 0xe12c, 0x8162, 0x4, 0x3, 0x1, 0x41, 0x7, 0x10000, 0x101, 0x8, 0xc000, 0x6, 0x4, 0x4, 0x5, 0x6, 0xfff, 0x0, 0x104, 0xf8ad, 0x2, 0x3, 0x7fffdfff], [0xfffffff8, 0xff, 0x4, 0x8, 0x1e0f, 0xfffffff7, 0x5, 0x7, 0xffffffff, 0x0, 0x6, 0x100, 0x8, 0xe63, 0x1, 0xa3a5, 0x2, 0x2, 0xb9, 0x6, 0x3, 0x43d, 0x6, 0xe, 0x4, 0x3, 0x6, 0x9, 0x1, 0x11, 0x5, 0x4, 0x8, 0x30000, 0x81, 0xfffffe00, 0x0, 0x10001, 0x7ff, 0x9, 0x8, 0xffffa467, 0x5, 0xfffffffb, 0x0, 0xff, 0x9, 0x6aac, 0x0, 0x3, 0x4, 0xfff, 0x200, 0xc1a, 0xe456, 0x100, 0x2, 0x0, 0x1c00000, 0x6, 0x3, 0xfffffff6, 0xffff1068, 0xffff9241], [0x9, 0x611, 0x6, 0xff, 0x101, 0x5, 0x0, 0x2, 0x80000001, 0x96, 0x7, 0x1, 0xfffffffa, 0x1, 0x4, 0xfb, 0x10001, 0x8, 0x8, 0x3, 0x1, 0x100001, 0x1, 0x7, 0x3, 0x40000000, 0x8, 0x3, 0x5, 0x3, 0xb89, 0xf, 0x0, 0x9, 0x3, 0xff, 0x0, 0x2, 0x1ff, 0x4501, 0x9, 0x0, 0x9, 0x7, 0x966, 0x6, 0x10000, 0xf, 0xffffffff, 0x9, 0xe2, 0x1, 0x8, 0x1, 0x8, 0x3ff, 0x5, 0xfffeffff, 0x3, 0x0, 0x80, 0x6, 0x7, 0xc], [0x5, 0x7f, 0x7, 0x9, 0x2, 0x6, 0x45c, 0x5, 0xab73, 0x5, 0x7, 0x0, 0x5, 0xed5a, 0x9, 0x4, 0x9, 0x8, 0x8, 0x3, 0xeb, 0x6, 0x5, 0xff, 0xffffffff, 0x7fff, 0x4, 0xcb7, 0xa3, 0xffff, 0x8, 0x80000000, 0x3, 0x1ff, 0xfffff26e, 0xf81e, 0x6, 0x9, 0x3, 0x8, 0x5, 0xe5, 0x2, 0x4, 0x4, 0x3, 0x0, 0xfffffff9, 0x7, 0x1ff, 0x204000, 0x5, 0x80, 0x9, 0x7, 0x5078, 0xd, 0x8001, 0x8000, 0x3000000, 0x200, 0x45, 0x0, 0x3]}, 0x45c) 4.335632736s ago: executing program 4 (id=1949): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c01000013000100000000000000000000000000000000000000000000000001ffffffff0000000000000000000000000000000d040000060a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000000000000000100000000000000fffffffffffffffffeffffffffffffff0300000000000000000000000000000000000000000000000000000000000000651700000000000000000000000000000000000000000000feffffff000000000001000000000000840005000a010101000000000000000000000000000004d62b00000002000000ac1414aa0000000000000000000000000000000004000000040000007f0000000000000008000000000000000000000000000000000000002b0000000200000000000000000000000000ffffac1414bb0000000004000000feffffbf00000000"], 0x13c}}, 0x10) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) truncate(0x0, 0x7) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff02000000fdff000000000000000001"], 0xfdef) 4.247638875s ago: executing program 3 (id=1950): unshare(0x60000600) r0 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e00)={0x84, &(0x7f0000000840)={0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)={0x40, 0x21, 0x1, 0x4}}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x234a047, 0x0, 0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000002100210100000000010000000a00000200000001000000001400110067656e65766531000000000000000000"], 0x30}}, 0x0) 3.964637167s ago: executing program 1 (id=1952): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_RANGE_FROM_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, '-'}]}, @NFTA_RANGE_SREG={0x8}, @NFTA_RANGE_OP={0x8}, @NFTA_RANGE_TO_DATA={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, 'RP'}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'veth1_to_bridge\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@fallback, 0xffffffffffffffff, 0x7}, 0x20) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8932, 0x0) bind$unix(r3, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, 0x0, &(0x7f0000000040)) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000b1e000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0xe1}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x20, 0x25, 0x301, 0x670bd24, 0x25dfdbfc, {0x15}, [@typed={0xa, 0x15e, 0x0, 0x0, @binary="378d39000000"}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008840}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x4c}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0xc0000000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.770854027s ago: executing program 4 (id=1953): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000000)="360f01300fc5c2070f78a2c4cfbaf80c66b824cb008c66efbafc0ced0f20a20fc73afb0fc7aa7dcb6ff080ad600006", 0x2f}], 0x1, 0x2, 0x0, 0x0) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (async) r3 = syz_open_dev$video4linux(&(0x7f0000000040), 0x2, 0x200) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc040564a, &(0x7f0000000000)={0x0, 0x1, 0x1012, 0xffffffffffffffff, 0x0, 0x0}) (async) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fce000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x3, 0x0, 0x0) (async) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x3000}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.509984108s ago: executing program 4 (id=1954): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_setup(0x1e64, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) (async) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r2, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe0}}], 0x68000, 0xe000) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001180)=ANY=[@ANYBLOB="3000000020000100000000000000000002"], 0x30}}, 0x4000) (async) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001180)=ANY=[@ANYBLOB="3000000020000100000000000000000002"], 0x30}}, 0x4000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) (async) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(0xffffffffffffffff, 0x0, 0x240088c0) 3.381459329s ago: executing program 5 (id=1955): syz_usb_connect(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0xa2, 0x91, 0x3a, 0x8, 0x763, 0x1015, 0x3933, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x9, 0x9, 0x30, 0x1b, "", [{{0x9, 0x4, 0xa0, 0x6, 0x3, 0xff, 0x7d, 0xec, 0x9, [], [{{0x9, 0x5, 0x4b8b109b436293d6, 0x1, 0x10, 0x84, 0xa, 0x7}}, {{0x9, 0x5, 0xc, 0x2, 0x20, 0x8, 0x9, 0x9}}, {{0x9, 0x5, 0xe, 0x10, 0x200, 0x2, 0x7f}}]}}]}}]}}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000040)) 3.324778258s ago: executing program 1 (id=1956): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYRES16=r1, @ANYBLOB="57dd20f34d3fcf6cecd9fed13fffcfbca71fe1c7530fdaab9ee3327453bc7527865eca5488d2198bc1540eec04753aa8790ff218a7d538263154ccd23788c0407e5a567c84bb78f6", @ANYRES64=r2], 0x0) 2.88697326s ago: executing program 2 (id=1958): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c000200080001ed02"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x4c, 0x10, 0x403, 0x300, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0xffe}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x4c}}, 0x8000) 2.623458939s ago: executing program 3 (id=1959): syz_usb_connect(0x0, 0x92e, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x6c, 0xb3, 0xb9, 0x20, 0x1164, 0x2edc, 0x94d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x91c, 0x3, 0x0, 0x0, 0x10, 0xdc, "", [{{0x9, 0x4, 0xed, 0x10, 0x0, 0x12, 0x1a, 0x20, 0x8, [@cdc_ncm={{0xa, 0x24, 0x6, 0x0, 0x1, "dc5a33fb29"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x8, 0xedd2, 0x4, 0x6}, {0x6, 0x24, 0x1a, 0x2, 0x2}, [@country_functional={0x6, 0x24, 0x7, 0x8, 0x5}, @mbim={0xc, 0x24, 0x1b, 0xf1, 0xa, 0xbe, 0xe4, 0x9, 0x5}]}, @cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "e13e74cebf5c"}, {0x5, 0x24, 0x0, 0x8000}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x3, 0x3ff, 0x4}, {0x6, 0x24, 0x1a, 0x7fff, 0x20}, [@acm={0x4}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0xe2, 0xf}, @mdlm_detail={0x53, 0x24, 0x13, 0x6, "0f9f3272e6fdfa8a1947ac2eb941ec2563616b301aa3fcf389debb87effa0e528016b47085d1c1f0165aa9dcdc2847ea2e1147d5d627293f199d57dbd8b7cb44d1dcf1d9999310de8b432f7590f559"}, @mdlm_detail={0x13, 0x24, 0x13, 0x3, "1e08c31fdaa55effbd033ad14ed52b"}, @mdlm_detail={0xf1, 0x24, 0x13, 0x5, "cd915f8399d503c816c57e08c599ef908644369848265a6b3cbfffa5e0ee6b970151b28d97de1ff2e0228b4b0f8b22b875169da96eeae2547d368d587f0641c0facc6f769bbaf2fbdb173158484ee95daf8cf87f322dbf69638b27f1e1190d6309ff322d1b4155fe35a01a65284f410256bbbd78a54b327265b0feca2a0b5ef304a9dab52e3241723aa6e39994e53d1b8bf40bea5bdea33cc9a620e48504cdf1fb8afe5c9b9fd9e18a984ed6d7970d94da610c5edd79e3848bdda1c62ae411c63141e3ab8d0b3ae31f78e63c3b806aae9f3aa11daf9fd8dd8359a14328d20c92dcb969b0c42f0ca38127cc1e4a"}]}]}}, {{0x9, 0x4, 0xe9, 0x8, 0x6, 0xca, 0xee, 0x2d, 0x7, [], [{{0x9, 0x5, 0xf, 0x0, 0x400, 0xff, 0x5, 0x6}}, {{0x9, 0x5, 0x1, 0xc, 0x40, 0x1, 0x80, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x7, 0x56}]}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0x1, 0x5, 0xc, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x5, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0xb8d}]}}, {{0x9, 0x5, 0xc, 0x9afd30be72ef347e, 0x8, 0x8, 0xf8, 0xc9, [@generic={0x60, 0x23, "72fc26cc515ae45b62c66c8b306c26b8d2875236d75d639c0879b8d05d063218c901ba366f3fcf3cf4e8f9e99b4a30593c155a07bdc2c0e74a3809f8ebd7e8e4ea4fca8d19d9cb031c310f2c50adbfb925ea2e56865f365db4c80ce7968b"}, @generic={0xfa, 0x23, "b6bdcc7afb38bfe75edbed2f3af23150b36c885d0aada4b6634a4c81c79d0dc8b22f8b53fca2122cc9b22ed0e34df3079c7ad451cdb36b407afffbda9f35c478d275e36d2f941d93e8fba541203684a85fd1f63af282c3b9beaf554491581ca1b2e08b9214fcddc72989a72ae83fe74d6cc0cb3d68b36913ddf2faa222e1bcd8e1ab30cec0aa5977a18d940548fa79bfb675c9a3308265c217200cc6b86927911d08a8a1376af8498b02b6fd2317ae6b68476462f999a671c125ee72a2b85f269e65f3c3363076a839a47e7a0084617a9ec3409ec3af17cd8ca293e3f9f49ba3ffdc733f44f354c97a24ae9170ae131da7bcffa72f6bc7ef"}]}}, {{0x9, 0x5, 0x5, 0x3, 0x3ff, 0x7f, 0x81, 0x2, [@generic={0x7c, 0xe, "772db2ba620cc2fe285d438f40cda5220ac5dfd5440b45bdad6742386c34569d01982b58021c8bcdb589fd1a12d97febeadd2ec437bcaba745310869bd8bbb9748a20502ab95ce0782bbceeba11f177aa33f075c2aec540badb4b16ab53e808efa8289439c3a46ed9b92fd6699886c47c00ed2bd91d68a1a04bd"}]}}, {{0x9, 0x5, 0x1, 0x1, 0x40, 0x7, 0x1, 0x3}}]}}, {{0x9, 0x4, 0x36, 0x7, 0x10, 0x96, 0x17, 0xe6, 0xa, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x2, 0xffff, 0xd6, 0x6}, {0x6, 0x24, 0x1a, 0x4, 0x29}}, @uac_control={{0xa, 0x24, 0x1, 0x3, 0x13}, [@feature_unit={0x9, 0x24, 0x6, 0x6, 0x2, 0x1, [0x2]}]}], [{{0x9, 0x5, 0x3, 0x2, 0x400, 0x5b, 0xa, 0xe, [@generic={0xd3, 0x9, "7364415c827d896f8cec3094ec91b1b8e3672d8fe456ecc6adc99856728a089f7cac391e183822e6b4876cf136e87de8f61ed97e64998622ce82011f0417ee08fa58db0cfd617428a10b39e148a1fe061f3797a6243570dea2f379dc7bde99fb4a92cefcfc56dcc5b53b62de5822fdfb0814a0629f5c20d590eccf85980190653e9e41359886e3de66dbc858fd1225479d093a903b530ea71bed78b08a1319b5d0ce8dec5d0b02e30deacf454f45b652c9fea94bf0d3eb45ed0c2e7040dd6d7d05d8d1991395cccb4e533601f6ae3a7b22"}, @generic={0x26, 0x2, "d8013bc961ea29970fc77e99b841514a097739cb0d44df090fb37a6ad60a004646598c4d"}]}}, {{0x9, 0x5, 0x80, 0x2, 0x10, 0x9, 0x4, 0xce}}, {{0x9, 0x5, 0xf, 0x3, 0x3ff, 0x3, 0x8, 0x80, [@generic={0xdf, 0x9, "422d3b965d6012ea98ef232366ad5a2121a3bbbd8356f51fd6e160127f3afd18044da64b50400163aff0082645f97b8810ada17e0661ba9e1c6e5669f442bf08457609a8bcc60b18ddddafcf13761221d2487d01d09ca8cf21f22a9f75ae86ead49d404c5a32cbbff9bf7d789898601093dce7ca0e1b8f83916821a4396265b03650ec2b02145e42dd24efc706e364c43d68a2ab5d7f5ddacf1aebbac5a518587ea1e93e110a9ab3fbc826124aee4bb14eaf52f46b4cc5bac35c038e7150134de66b4a3fc9fdcf678bac68c34f3fd297d14eca055f27a33cf0d611a0ca"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0x80, 0x5, 0x1}}, {{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x7, 0x66, 0x8d, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x10, 0x7}, @generic={0xbe, 0xe, "304a11311fca24012fd81cda40c9b2031453b3794d1254e9539879033c808360d007f49d44161bbcd5c1c4c9899425c494c22311de2c549ccdcb98c52cd1fd70eba45c1370d66ffb748f260db8e56406f137fea76a6dfd24ec4a0d2ddb54a93454b6c0129fc62100feb8d916c7d77d91981282c852aaac4faed2a477dc956239d6e84ef574090877c7bd13992444603fad401c7badec0b0c3bb2ce8d3d11db3c39de4aa450c367d6a9f065375c4857cbc74298a0575585bc19a6f9b0"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x400, 0x3, 0xd8, 0xab, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x3, 0xf000}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0xe1a7}]}}, {{0x9, 0x5, 0xc, 0x8, 0x200, 0x1, 0x1, 0x2, [@generic={0x4e, 0xe, "646aa87d5c89412254c272dee188cba88f49c719740ab54de50466bf3009a946149341e8e4eb97a50544a6b659f19f26976639b8a59d9feddc3db57c9009bd43d5748ed51698c55255466b37"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x3ff, 0x8, 0x6, 0x5}}, {{0x9, 0x5, 0x5, 0x0, 0x20, 0x8, 0xa, 0x5, [@generic={0x9c, 0x23, "679855f73b93573a52bc0b4b150802f1319d1004ba7e7c1f302bd4bbd960c0e7e7433a1992bad4baf909ae1aa1a98b5b1287b533276af2d704f573d41fe58331171d9d6646a3d5e067a824ba01b4c4305d7c0416fde63428a3d5165eff78ce392f3d3b221af7980448fb483119067ef707974b7b34067d729d1d8f685b3c1e6eaf3db3a56656b87377dad78807dc1b752d84ab420f61a439632e"}]}}, {{0x9, 0x5, 0xc, 0x0, 0x8, 0x8, 0x7, 0xe}}, {{0x9, 0x5, 0x5, 0x0, 0x8, 0x1, 0x8, 0x5}}, {{0x9, 0x5, 0x0, 0x10, 0x67602fd53445ab5d, 0x4, 0x1, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0x81}, @generic={0xa5, 0x2, "5fbc248057e8f4e067866e84f0017f0fd2b3116f28f9d9a024ee79302a0ffb64f119fc8ca5d4d0de407fd480f95bd377a6727e5c641146750e6d830f381f2b7e829e64674dfb128bf780776e1372716c6bd1e46244c6af105960a9f7d8d85217ef4f828ba02ec1ddc313b9d011292b38aa71434c379bd4f430a8538d1997c1b6b029aeb3b6dfd93fdb6442862306e75d5df243f974e07b1892325a4bba3a413d25b090"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x40, 0x9, 0x0, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xc2, 0x9}]}}, {{0x9, 0x5, 0x8, 0x0, 0x40, 0x0, 0x10, 0x2}}, {{0x9, 0x5, 0x0, 0x8, 0x10, 0xf, 0xb2, 0xa3, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xf, 0x7}]}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x3, 0x0, 0x39, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x90, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x80, 0xed}]}}]}}]}}]}}, 0x0) fsopen(0x0, 0x0) 2.416376623s ago: executing program 4 (id=1960): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r2, 0x3b87, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) sendmsg$NL80211_CMD_DEL_STATION(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4c0c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180)) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r8, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x2, 0x2, r7, &(0x7f00000002c0)="3251889bf8042a4a938905979f0c0bf552054f2c1a35aa7b3099e457f87e73fb25573217847517b65573d1cc7d1bdf87b3ba5d591cff1e4224c18e6013215fcd4bbbb5439b882c9afd761b7327784cf01d4c9acb2d62b164d6a08eb15ac4ff9d7a", 0x61, 0x4000000000000001, 0x0, 0x1}]) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[], 0x5c}}, 0x4000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x86) fsmount(0xffffffffffffffff, 0x1, 0x7) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r10, 0x1, 0x70bd27, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) syz_open_dev$ttys(0xc, 0x2, 0x0) 2.032162627s ago: executing program 2 (id=1961): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r1, &(0x7f0000000480)={&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000003c0)=[{&(0x7f0000000100)="f6772424abf3ce047fe4089859881317", 0x10}, {&(0x7f0000000140)="b88b079e6649b04eb4a280c5072c9d3806edbdf4efd4186beb133cf6fa4604406d23b8e4c090862efd3ef40cf1b6597511bb0fb03f921f9ec7e40d6221af7adaeb74411d31d9ccfe8ee5cd2d936ea167a0abe6f5a0ccfd", 0x57}, {&(0x7f00000001c0)="bb945caccd2b1c183e524baaa53b5bfbc62d5db37d29c6c7940fd6b2364920a462699ef612418782e65871b0bc0b7e077fee361f168fd92b10217557e2661d41d398af71dd18ae99dab53a0ff523590b986fe13c361c0ed446f1dd956d41f1e149edc1c81ca4f991ac1531", 0x6b}, {&(0x7f0000000240)="032556f86b6a170fe6957a126386b0347fb68ada67883839ea5f96d4e2cd1cc734c703e13603ae82d35f351313af9f47f55a9b22a1b9109b3cd47a3a762ac8273224686588ffe344c9434115adffdad78bb35c07a15093288e8945248356f50536045e64d83d0eae77e47f18ef1bb00c6eec4df6e39eca3127b4214ee855a13efbda3f80e0a00956935d42748b3da9c680de824f827b6c463bc4f5dbc44fff1153dd80958d18d35a0154003f94202619f8e6747120d16d386401ffa6328cee1eca7e3c22533e2eb6", 0xc8}, {&(0x7f0000000340)="e9321362b8ecccfb8f20c12fb5f61e756743bcfe94d36fda0417be289c21e15236cdaecc09d670579a4462c178846ef16086aee665c9168c9a035a08766e17350895462b2b34990fb430edfe826e4d008b9990c4ac7abafa479e279ffe04463e614a801f620c", 0x66}], 0x5, &(0x7f0000000440), 0x0, 0x8010}, 0x24040804) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0xfffffffffffffffe) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netlink\x00') r4 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f40)=@ipv6_newaddr={0x34, 0x14, 0x101, 0x70bd26, 0x25dfdbfd, {0xa, 0x38, 0x78, 0xff, r5}, [@IFA_FLAGS={0x8, 0x8, 0x694}, @IFA_LOCAL={0x14, 0x2, @loopback}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004051}, 0x4) close(r3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = mq_open(&(0x7f0000000880)='.\xdf{\x00', 0x40, 0xc0, 0x0) mq_timedsend(r7, 0x0, 0x0, 0x9, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x2, 0x0, [{0xd, 0xd, 0x0, 0x101, 0x7, 0xf15, 0xfffffffc}, {0x80000008, 0xffff8001, 0x5, 0x30003900, 0x6, 0x2, 0x9}]}) socket$kcm(0x29, 0x7, 0x0) 1.800622452s ago: executing program 2 (id=1962): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000800)={0x0, {0xfffffff9, 0x0, 0x8, 0x3, 0x3, 0xbb}}) write$uinput_user_dev(r0, &(0x7f0000000240)={'syz0\x00', {0x9, 0x1, 0x2, 0x3}, 0x2, [0x5, 0x5, 0x81, 0x8, 0x4, 0x1000, 0x50000, 0x1, 0x10001, 0xffffa103, 0x3, 0x6, 0x6, 0x6, 0x7, 0x3, 0x6, 0x0, 0x40, 0x5, 0x1cac, 0x3eb, 0xb8f, 0x3, 0x400, 0x40, 0x6, 0x0, 0xfffffffa, 0xdc, 0xffffffff, 0xa1bc, 0x200, 0x7, 0x6, 0x6, 0x3, 0x1, 0x0, 0x0, 0x2, 0x400, 0x7a08, 0x200, 0x3, 0x6, 0x7ff, 0x7f, 0x1c, 0x7, 0xe, 0x9, 0x5, 0xa, 0x3, 0x2, 0xf7, 0xfff, 0x71, 0x5, 0x1ac0, 0x4f, 0x6, 0x8], [0x5, 0x3ff, 0x6, 0xea, 0x3, 0x0, 0xca, 0x1c5936c5, 0x9, 0xfffffff8, 0x4, 0x1, 0x7, 0x6, 0xa, 0x4, 0x2, 0x0, 0x5, 0x2, 0x0, 0x6, 0x0, 0x1, 0x9, 0x6, 0x5e5893ee, 0xfffffff7, 0x9, 0x10000, 0x3, 0x8001, 0x2e6d, 0x7ff, 0x1, 0x9000, 0x877, 0x9, 0x8, 0x8, 0x80000000, 0xfff, 0x5, 0x7, 0x8, 0x5, 0x75da, 0x2, 0x5, 0xe8, 0x3, 0x9, 0x5, 0x7, 0xb99c, 0x2, 0x1000001, 0x4, 0x4, 0x1, 0x1, 0x9, 0x2, 0xc406], [0x80000001, 0x2, 0x9, 0x9, 0x0, 0xb9, 0x897, 0x5, 0x3, 0x4, 0x2, 0x5, 0x3, 0x9, 0x9, 0x7, 0x9, 0x61, 0x9, 0x5, 0x9, 0x8, 0x2, 0x6, 0x8001, 0x4, 0xc, 0x80000000, 0x7fffffff, 0x1, 0x1, 0x6, 0x8, 0x3, 0x2, 0x5, 0x3, 0x2, 0x1, 0x24, 0x9, 0x2000000, 0x4, 0xff, 0x7, 0x3eef6cc9, 0x1, 0x7, 0x7, 0x8bd, 0x9, 0xfffffff9, 0x80000001, 0x5, 0xffffff1d, 0x6, 0x0, 0xa, 0xfff, 0xfff, 0x1, 0x1, 0x19ee, 0xfffffff9], [0x0, 0x10, 0x101, 0x2, 0x4, 0x9c500, 0xef, 0x8, 0xc61, 0x7, 0x1d, 0x358, 0xd567, 0x1d5, 0xc8b, 0x658, 0xcbfd, 0x101, 0x6, 0x5, 0xb, 0x5, 0x6, 0x3, 0x75d6, 0xb26, 0x3ff, 0x6, 0x9, 0x0, 0x1, 0xf412, 0x2, 0x2, 0x2000002, 0x3, 0x3, 0x9, 0x3, 0x5, 0x3, 0x3, 0xfffffff3, 0x8000, 0x6, 0x6, 0xffff, 0x80, 0xf, 0xfff, 0xfff, 0xffff, 0xfffffffe, 0x80, 0xb975, 0x5, 0x5e1, 0xa, 0xffff58ee, 0x2, 0x2530, 0x4, 0x26da282, 0xc]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000d80)={'syz0\x00', {0xb, 0x3, 0x4, 0x9}, 0x3, [0x3ffffff8, 0x0, 0x0, 0x3, 0xf, 0x0, 0x7ff, 0xa, 0x5, 0x3, 0x5, 0x40, 0x1, 0x1, 0x7, 0x6, 0x0, 0x7, 0x1, 0xdef, 0x9, 0x7, 0x200, 0x5, 0x73c, 0x5, 0x4, 0x7f, 0x4, 0x6, 0xfffffff9, 0x8, 0x6, 0x4, 0x7, 0x7, 0x1939, 0x8, 0x7, 0x2, 0xe12c, 0x8162, 0x4, 0x3, 0x1, 0x41, 0x7, 0x10000, 0x101, 0x8, 0xc000, 0x6, 0x4, 0x4, 0x5, 0x6, 0xfff, 0x0, 0x104, 0xf8ad, 0x2, 0x3, 0x7fffdfff], [0xfffffff8, 0xff, 0x4, 0x8, 0x1e0f, 0xfffffff7, 0x5, 0x7, 0xffffffff, 0x0, 0x6, 0x100, 0x8, 0xe63, 0x1, 0xa3a5, 0x2, 0x2, 0xb9, 0x6, 0x3, 0x43d, 0x6, 0xe, 0x4, 0x3, 0x6, 0x9, 0x1, 0x11, 0x5, 0x4, 0x8, 0x30000, 0x81, 0xfffffe00, 0x0, 0x10001, 0x7ff, 0x9, 0x8, 0xffffa467, 0x5, 0xfffffffb, 0x0, 0xff, 0x9, 0x6aac, 0x0, 0x3, 0x4, 0xfff, 0x200, 0xc1a, 0xe456, 0x100, 0x2, 0x0, 0x1c00000, 0x6, 0x3, 0xfffffff6, 0xffff1068, 0xffff9241], [0x9, 0x611, 0x6, 0xff, 0x101, 0x5, 0x0, 0x2, 0x80000001, 0x96, 0x7, 0x1, 0xfffffffa, 0x1, 0x4, 0xfb, 0x10001, 0x8, 0x8, 0x3, 0x1, 0x100001, 0x1, 0x7, 0x3, 0x40000000, 0x8, 0x3, 0x5, 0x3, 0xb89, 0xf, 0x0, 0x9, 0x3, 0xff, 0x0, 0x2, 0x1ff, 0x4501, 0x9, 0x0, 0x9, 0x7, 0x966, 0x6, 0x10000, 0xf, 0xffffffff, 0x9, 0xe2, 0x1, 0x8, 0x1, 0x8, 0x3ff, 0x5, 0xfffeffff, 0x3, 0x0, 0x80, 0x6, 0x7, 0xc], [0x5, 0x7f, 0x7, 0x9, 0x2, 0x6, 0x45c, 0x5, 0xab73, 0x5, 0x7, 0x0, 0x5, 0xed5a, 0x9, 0x4, 0x9, 0x8, 0x8, 0x3, 0xeb, 0x6, 0x5, 0xff, 0xffffffff, 0x7fff, 0x4, 0xcb7, 0xa3, 0xffff, 0x8, 0x80000000, 0x3, 0x1ff, 0xfffff26e, 0xf81e, 0x6, 0x9, 0x3, 0x8, 0x5, 0xe5, 0x2, 0x4, 0x4, 0x3, 0x0, 0xfffffff9, 0x7, 0x1ff, 0x204000, 0x5, 0x80, 0x9, 0x7, 0x5078, 0xd, 0x8001, 0x8000, 0x3000000, 0x200, 0x45, 0x0, 0x3]}, 0x45c) 1.578162608s ago: executing program 5 (id=1963): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r0, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x5, r0, 0x0, &(0x7f0000ff8000/0x2000)=nil, 0x2000, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r0, 0x0, &(0x7f0000ff7000/0x3000)=nil, 0x3000}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$FUSE_INIT(r4, &(0x7f0000002340)={0x47, 0xfffffffffffffffe, 0x0, {0x7, 0x29, 0x0, 0x20582a, 0x0, 0x0, 0x9}}, 0x50) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r2}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca0000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}}, 0x40000) openat$fb0(0xffffffffffffff9c, &(0x7f0000000100), 0x21ca00, 0x0) r5 = open(&(0x7f0000000000)='.\x00', 0x0, 0x6c) fcntl$notify(r5, 0x402, 0x26) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000001040)={0xfc, {"a2e3ad09edfc09f91b44090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b0732306c090890e0879b0a0ac6e70a9b3361959b4b9a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb000000002f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d6ced5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed700129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb21fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) preadv(r5, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x48, 0x2, r0, 0x0, 0x0, 0x0}) ioctl$IOMMU_DESTROY$hwpt(r5, 0x3b80, &(0x7f0000000300)={0x8, r8}) write$6lowpan_control(r5, &(0x7f0000000200)='disconnect aa:aa:aa:aa:aa:11 1', 0x1e) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 1.100987208s ago: executing program 5 (id=1964): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000008c0)=r5, 0x4) pipe(&(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000980)=[{&(0x7f00000004c0)="18e41dbb2ed7b8c3f09c9f04a4d383dc4f19f21d34bf79ab962e9e70bd4f14bacc0726cfd4be1811d4026e544c6724b37fa1923b3c02f9f5e7a6e865c7060b0d9f7c241603fc82c9d2ae66b8ec07d11c1db3205c31597ed6089354a6c17987edece5730c65f312e5ca4e91be2553b88e202b7a65c6d2385d8849289c8e2e08a1157860f193afc69748bc4921a728c65cb6544e1b2abdb01cd63d79b90d9d2a07565ec23235c81de634b6e471fbe8dd59309c4a21f28cbb", 0xb7}, {&(0x7f0000000080)="846c95fcac70ccdc625119eece2fdf26e918577b5810fc9978", 0x19}, {&(0x7f00000002c0)="de895d62ec8e", 0x6}], 0x3, 0xc) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000001500)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r8, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r6, 0x0, r8, 0x0, 0x2000000002ffff, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x4}, 0x8) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) close_range(r2, 0xffffffffffffffff, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) r10 = openat$vsock(0xffffffffffffff9c, &(0x7f00000011c0), 0x10000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000013c0)={r10, &(0x7f00000012c0)="0f25d43832a0d2ef54616d1827f148e9a61e89dbb213d27fe390da810bedade65da3d85112d298556f4ca77e5eec9f6cebd67f5ceeb7ba9c73a4c84c5f04f5f3820b01b5e5b9a148bd5f92e00673cd1a2a9e0617a039be77d37ca237109335fdf58482c6e02818e3fe64aea183fff5e548d7b8cc50b65a392c8ece4239fb50fb255747387c100485ae7ba13306de335e5eb973cfd89d6a58acc9a704323867b91df16658", &(0x7f0000001380)}, 0x20) preadv(r9, &(0x7f00000015c0)=[{&(0x7f0000000140)=""/4078, 0xfee}], 0x1, 0xed, 0x207fff) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$XFS_IOC_READLINK_BY_HANDLE(r9, 0xc038586c, &(0x7f0000001440)={r3, &(0x7f0000001200)='/dev/vsock\x00', 0x100, &(0x7f0000001240)={@align=0x7, {0xc, 0xe, 0xfffffffb, 0xf5b}}, 0x296, &(0x7f0000001380)={@_ha_fsid}, &(0x7f0000001400)=0x1}) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bfe000/0x400000)=nil) syz_usb_connect(0x4, 0x322, &(0x7f0000001600)={{0x12, 0x1, 0x110, 0x6b, 0xd2, 0x78, 0xff, 0x17a8, 0x5, 0x8b9e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x310, 0x1, 0x4b, 0x1, 0xb0, 0xb, "", [{{0x9, 0x4, 0x72, 0x2, 0x7, 0xc2, 0xf, 0xbf, 0x9, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "06f414fa885d"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x9, 0x0, 0xfa}, [@mdlm={0x15, 0x24, 0x12, 0xe228}, @mdlm_detail={0x24, 0x24, 0x13, 0x7f, "63832544b5992729c2c21e14138e14d2545f2904857f9925c82a39c66ef2f284"}, @network_terminal={0x7, 0x24, 0xa, 0x1, 0x0, 0x8, 0x9}, @mbim={0xc, 0x24, 0x1b, 0x6, 0xe, 0x3, 0x9c, 0x6, 0xd2}, @mdlm={0x15, 0x24, 0x12, 0x7}, @dmm={0x7, 0x24, 0x14, 0x6, 0x5}]}, @generic={0x18, 0x22, "dc18ffa56b88c91cf826bf9af4fcb8b91f3729e3a30a"}], [{{0x9, 0x5, 0x2, 0x10, 0x10, 0x9, 0x0, 0x42, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0x5}]}}, {{0x9, 0x5, 0xf, 0x8, 0x10, 0x9, 0xdb, 0x1, [@generic={0x2f, 0x5, "e02d445a237f7e38d12a55d30b777b3e32b3b9122286b587f66d616520d33917272bf2b1b18aa485f6a33640c7"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x10, 0x75, 0x23, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7f, 0xceb4}]}}, {{0x9, 0x5, 0x1, 0x0, 0x400, 0x9, 0x7f, 0x0, [@generic={0x99, 0x4, "bfc726695c3a35b0a914b9b91a695a36f352343aac85c7bea9a43db9c81f4a275d0a4be00dd66887c9d3baa5866910786d010b00057a7db0143fbd1d075a8bc9159a40cd5568ecaccaaea14420addc45cfaeb006a11388abd9d84e5d9c127688ffd3aa47edec6af3c344ffd12b654bee5fe77fd336d56cccb1fb2575dc0114994a0efd69ce5ec0e26cf59e8f357c40f1df22d5e70d1ea8"}, @generic={0x7d, 0x7, "4a1e14eaceb5f692d68d95b953f20a4793a92a54c2045455450c18cff69e544e7397ded88a1ed7c7902f7cbb5e8d93faf0a25b01a4281e19699ef38a607b5752c9e4c8f1ec8da0c58296914c1aeef1ca1b6081714d90621c808239b044ef2900beb4d2a2e5054a78ebce4f7161b437e51e3bb125b22c7eb250b77c"}]}}, {{0x9, 0x5, 0x3, 0x4, 0x3ff, 0x4, 0x4, 0x70, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x7d, 0x8001}, @generic={0x39, 0x22, "fae95515649ed2d625428b910973775dfc23b93e4e5d5450df8e2ef7a672792b752e6a5c7463e513298db741b78a4a9d74d102f10f74f1"}]}}, {{0x9, 0x5, 0x2, 0xc, 0x20, 0x1, 0xff, 0xa, [@generic={0x6a, 0xd, "79ca462f6f6175a303cf504955387551b1b2e8fafda8f045e66fb05fc9680ddfcf3d9d4016678067b1abb9ff050bea53fb39965fbd50c4add37de35ad2d37cc0793fe772c5b42f049c2b03b4ccb834471cf09fe594005b28fd68382f5877596c52d0aba2cb67cac3"}, @generic={0x25, 0xe, "d9eeb140fbeb72e3ae1f58ed32fc9737f0e728e75ee23c6b68923ec50fa7069db6c44b"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x20, 0x4, 0x8d, 0x6}}]}}]}}]}}, &(0x7f0000001cc0)={0xa, &(0x7f0000001980)={0xa, 0x6, 0x250, 0xb2, 0x25, 0x7, 0x40, 0x96}, 0xa6, &(0x7f00000019c0)={0x5, 0xf, 0xa6, 0x6, [@wireless={0xb, 0x10, 0x1, 0xc, 0xae, 0x81, 0x1, 0x102, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "34e85c8f6f181c451c2b7a643255ac3e"}, @ssp_cap={0x1c, 0x10, 0xa, 0xff, 0x4, 0x6, 0x0, 0xfffc, [0xffff0f, 0x3fc0, 0x3fc0, 0xffc000]}, @generic={0x2e, 0x10, 0xb, "5cedcff9a96681ac319d477488d63e7157d0ef22976b3e7ab043ab2e57f5330448a63953b7a4b6161356d2"}, @ssp_cap={0x24, 0x10, 0xa, 0x96, 0x6, 0x10000, 0x780f, 0x8, [0xc0, 0x0, 0xff3f3f, 0xc0, 0x6f, 0x0]}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "657292ed87d0b33653ec67e4f197bec1"}]}, 0x5, [{0x4, &(0x7f0000001a80)=@lang_id={0x3f, 0x3, 0xca3e3a43493e1508}}, {0x21, &(0x7f0000001ac0)=@string={0x21, 0x3, "91934ed6cfe4cbd1be2cad26b5a8b95f817f8d0e1af255325cc324dceec7d7"}}, {0xf4, &(0x7f0000001b00)=@string={0xf4, 0x3, "4527be8a1cb45db394ce43ce3cf66e86a1f3718f99958960e49d3186cce9249c78cf00abffa08409f98f6984121f9b6287f681445f6600313b6196cbf74d06a98a9f4740cb3240c63efcf54b1af16b301045d49068617fdd042fe04847595ba9ffbc7cee5543578a4b176f7ed00f5d0f979339c6a1592282e36d4131c911915495875740e44f81253768fcf1d8071ad8224dbb70ece71a9f6fdfb71dba17c5959cbba9f69631ab4c60b70863c4dde2092d6194b70576c10278abff5bd9a641d9e5095fb98e43fd09e21d17f1d938402de9ff9f6ed799fb9d6187a2445ccfc5bcd0bbc6aaf7f9099c2f92b26124fbde1a43ab"}}, {0x6c, &(0x7f0000001140)=ANY=[@ANYBLOB="6c0348e9ff0000000000000005073d085caf7fd5b377150b696565324c843ce8598cb47b4273e708a667d1d781340efdaf73451952d25170bda5dfd9914c74cedcb9b8f1551fd99c2f64b78d015ab4990ca4b20b9cd6149d7857808bfca0d123fce81816db708ee0fb8cf653e1"]}, {0x4, &(0x7f0000001c80)=@lang_id={0x4, 0x3, 0x414}}]}) r11 = syz_usb_connect(0x5, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010601bc3bd020402012c651e50102030109021200017b63200909040002"], 0x0) syz_usb_control_io(r11, &(0x7f0000000b00)={0x2c, 0x0, &(0x7f0000000980)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r11, 0x0, 0x0) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r12, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000000800)={0x10, 0x1401, 0x1, 0x70bd27, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 1.100179879s ago: executing program 2 (id=1965): syz_usb_connect(0x0, 0x34, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100002c464708c2153b003e66010203010902220001000000000904000001e3fe11000905000000000000000705936b90"], 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80040, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) add_key$fscrypt_provisioning(0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="020000000000000061626364"], 0x18, 0xfffffffffffffffd) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2, 0xa8d4}}, './file0\x00'}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) dup(r0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)) (async) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000500), 0x8, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r4], 0x80}, 0x1, 0x0, 0x0, 0x20000040}, 0x20008800) (async) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYRES16, @ANYBLOB="0500000000", @ANYRESDEC=r0], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) r5 = add_key$user(&(0x7f00000002c0), &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9", 0x5, 0xfffffffffffffffe) (async) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r5, r6, r5}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) (async) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async) set_mempolicy(0x5, &(0x7f0000000000)=0x2, 0x6) r9 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x282a2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000200)=0xe) close_range(r9, r9, 0x0) (async) r10 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0, 0x3a}], 0x1, 0x8, 0x0, 0x0) (async) ioctl$KVM_RUN(r11, 0xae80, 0x0) 580.848118ms ago: executing program 2 (id=1966): syz_usb_connect$cdc_ncm(0x2, 0x97, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003020000402505a1a44000010203010902"], &(0x7f00000003c0)={0x0, 0x0, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="020f"]}) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x50, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r0, {}, {0xffff, 0xffff}, {0x2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0xff}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x6, 0x100, 0x4005d, 0x2, 0x7ff, 0x1fe}}, {0x4}}]}]}, 0x50}}, 0x0) (async) r2 = syz_usb_connect$uac3(0x3, 0xbe, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x582, 0x89, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xac, 0x3, 0x1, 0x2, 0x0, 0xb, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x57}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x3, 0x31, 0x180}, [@output_terminal={0x13, 0x24, 0x3, 0x2, 0x306, 0x6, 0x4, 0x2, 0x7, 0xe, 0x401, 0x9}, @input_terminal={0x14, 0x24, 0x2, 0x5, 0x402, 0x5, 0x4, 0x3000, 0x5, 0x40, 0x8bd, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x6, 0x3, 0x2, 0x8, "ab", "54f3"}]}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x3, 0x9, 0x6, {0xa, 0x25, 0x25, 0xaea, 0x3, 0x4a4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x8, 0x3, 0x7, {0xa, 0x25, 0x25, 0x8, 0xe, 0x3}}}}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0xd, 0x1, 0x0, 0x20}, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="050f056300"], 0x6, [{0xf, &(0x7f0000000240)=@string={0xf, 0x3, "3e5724262493e511b1c6e18ed4"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4}}, {0xff, &(0x7f00000002c0)=ANY=[@ANYBLOB="ff03b13312eebd1941d6ae98fbbb0350055a4e43569b3c41195d318aaa860e6fd6ef165f55f0b6f4af8383391cb1f8fbc1613242b184b88c0933325ef70474e3277bc1715005820d18d89dd2eb1da15fe2d88931d98d08bc977b6dca3348166f7ea1921f86e9e403d059d770e286249381b595945a80b31ec01d9c36f3fed372d384db62e4da4c6876bdde9543f70c57a278cfa830aede9bd04fdf00709ca91744dcf752efa3c21dc6e77e44bf5c7c427ca2ac7bfe31f55b65e795c85c6fa863795e43c7b61cf2d68151625f1de3a482dc4ce165e44fa3f2d61a09026d946b4f762533ed18f6f1ee964e9860defeabbd4961243c2614d539b27998ed4fb8f2"]}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x41d}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x414}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x240a}}]}) (async) syz_usb_connect$uac3(0x0, 0xfa, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x1235, 0x4661, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe8, 0x3, 0x1, 0xc, 0x70, 0xa4, {0x8, 0xb, 0x0, 0x1, 0x1, 0x26, 0x30, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x7, 0x4, 0x9, 0x81}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x94, 0x3, 0xc, 0xc, "0d8aa0"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0xb4b, 0x7fff, 0x7, "1dd0be8617031097"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x516, 0x8, 0x8, "95c11a7208aa8a8b"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0xe, 0x63, 0x8, 0x2}, @as_header={0x17, 0x24, 0x1, 0xfc, 0xffff0001, 0x0, 0x0, 0x7f, 0x8, 0x2, 0x9}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x3, 0xc0, 0x1, {0xa, 0x25, 0x25, 0x80, 0x4, 0x1000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x3c, 0x4, 0x6, 0xbc, "7687e5", "72a3c4"}, @as_header={0x17, 0x24, 0x1, 0x2, 0xa5, 0x218, 0x5, 0x81, 0x7, 0x9, 0x8}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x8, 0x4d, 0xd, {0xa, 0x25, 0x25, 0xfffffffd, 0x0, 0x3e}}}}}}}}]}}, &(0x7f0000000a40)={0xa, &(0x7f0000000640)={0xa, 0x6, 0x201, 0x7, 0xfa, 0x99, 0x28, 0x40}, 0x12, &(0x7f0000000680)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x0, 0x5, 0xf39}]}, 0x5, [{0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x3c01}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x41c}}, {0xcf, &(0x7f0000000800)=@string={0xcf, 0x3, "05b288944de485e6c644e614a646adb28a6b36cb626f811470909acbc28f32381c835072196c2ea53a49778a42e2b29144a7e2d02402734a63e3f8b8bc784255e4ac9e9b77a0e3ba2d8ac455bbb3b598fcdbbaed772d0dfa4a08335ffe492a781dbcd734749e95828598dba5998230720473fee81c92864b8e6464e7a1ddfbe474ad3e25470ae1b9be83d7b0f55cf485ed05f8e323375dd9358cf36bad032d3a7a899254f2e78410b9670899a0e446e1ec8a751115e14d63bd6754a1e74c7cc23c467b7f2d7a6d1b7dd21eeeb8"}}, {0xed, &(0x7f0000000900)=@string={0xed, 0x3, "cdb6ec97472216d3f9cc1b1471f7c1c4941809025f253a5dd58053e84a7f044b7cf3da0607bb1be73f407812ea3ba6500513b576ddb28d64e9dfbb82455d1c0f88aac21aacb3cb8fef11a541bb2e484b86a9d40df90d1da10c16e3edf937d420694f9f32b890a51ca14e9040f6b42596e4e6c2bebaeec9117d64d59c8703efe2abebc07f687ce3f8cee6c647284c9615c491813ce5ab887772b331e7c4991219d6c0bd774703bde66c2e542dbb98c613cd7b7993bfa5efe2c20812d81fa548b7f872211c75bc49ec93f91866b7f645c0dcacabb37a2021a9b373ed6cb2a4c26002b993648a487c62a16450"}}, {0x17, &(0x7f0000000a00)=@string={0x17, 0x3, "c7d635c06c597ec715468fa5bff72b9843c50d667a"}}]}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=@newlink={0x28, 0x10, 0x439, 0x70bd3d, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000007}, 0x0) (async) syz_usb_control_io$uac3(r2, &(0x7f0000000c80)={0x14, &(0x7f0000000ac0)={0x0, 0xd, 0xc8, {0xc8, 0x4, "cfdb23f7b54dde94fb7060daaf6c8f87bf52c419a4f65842f1d0dab0cce8050fb48042044b1b2bc0c9e7a5348e745ee1445134a7cf5cf2d33ce8b2da61a4397187b1a515f341894be7d6c3ce7f2f46a6a1b12c68e79526da4706fd22585aacbf3cf3b6c507d397353c04df948cb57877f9cf45652fc1ca0d752d73fab2b8cce127000251563b234334436320e11c628bef2dec1d814c3571af1106beff40a9e4f27eecde2289e79a7f81552d0352e753701205d7a2460e414faccdffb3d100ae54d9b8adc529"}}, &(0x7f0000000bc0)={0x0, 0x3, 0xb1, @string={0xb1, 0x3, "e4cf609a94765829e610e157073ae680edf71636dce369bb0cfabee2aeb6248b8a34a46abe8bcfee20383a978daad3c6ba67e18fd1371560528bfbeb9fb20135c2b015295d96b75f34b11d567834dfb641c739e1a09ca0a028d70b4bf92a3d4c9dec1364853c2fee5d821d3a1a7933e57383d34214cddc9956bda356bfef505aa99c2638517b8911ca4f51160a9ed02043d2caab3a81a8b9e884ced467535af138c8a960c075b2d169536bbc76f1bf"}}}, &(0x7f0000000f00)={0x44, &(0x7f0000000cc0)={0x20, 0x15, 0x62, "dcb2b7e8a242fe3e76b534f90f6ef7483a27213c9af40286b22b21e67cc39eee8301ef07bbe496248fa7b038dba733064c701c08581de6fed213ef7b81bb9a15f50797d51996c996912f90bf63363c9c073a9a80b1f7e9375b52ee9f2da4f64d865c"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000dc0)={0x20, 0x81, 0x2, "ebc1"}, &(0x7f0000000e00)={0x20, 0x82, 0x3, "ec9ddc"}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 'i$'}, &(0x7f0000000e80)={0x20, 0x84, 0x2, "8abc"}, &(0x7f0000000ec0)={0x20, 0x85, 0x3, "7deb90"}}) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) r5 = socket(0x10, 0x803, 0x0) sendto(r5, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r5, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000a00)=""/178, 0xb2}], 0x1}, 0x2}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x40000022, 0x0) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x800b, 0xa9, 0x7}, 0x0) (async) recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x43}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001280), r1) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) (async) sendmsg$NL80211_CMD_SET_KEY(r5, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x24, r6, 0x800, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8850}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000f80)={'tunl0\x00', &(0x7f0000000740)={'syztnl0\x00', r0, 0x80, 0x20, 0xebe9764, 0xc, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x64, 0x0, 0xd, 0x4, 0x0, @empty, @local, {[@end]}}}}}) (async) r12 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r12, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\\/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@broadcast, @in=@dev}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000200)=0xe4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_dev$media(&(0x7f00000000c0), 0x8105, 0x8400) ptrace$ARCH_MAP_VDSO_64(0x1e, 0x0, 0x3, 0x2003) bind$packet(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x4) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x880}, 0x4001) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1f00000000000000000000000080000000000000", @ANYRES32=r0, @ANYRES16=r1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) fcntl$lock(r2, 0x26, &(0x7f0000000400)={0x1, 0x0, 0x9, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0xf, &(0x7f0000000640)=ANY=[@ANYBLOB="00400092c117013d9a17dd8334bc950208e746a15200000000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000030000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff0a, 0x0, 0x0, 0x0}, 0x94) fsopen(&(0x7f0000000100)='zonefs\x00', 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$getownex(r3, 0x10, 0x0) bind$inet(r5, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e21, @multicast2}, 0x10) sendfile(r5, r3, 0x0, 0x20000023893) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x5d}, [@ldst={0x5, 0x3, 0x3, 0xa}]}, &(0x7f0000000440)='syzkaller\x00', 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x10}, 0x10}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2eb2b00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c08000140000000020800014000000030080002400000000308000140000000120800034000000000080003400000000a"], 0x122}, 0x1, 0x0, 0x0, 0x8840}, 0x8010) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d8ca8d40d10521200009001000010902120001000000000904"], 0x0) 0s ago: executing program 1 (id=1968): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) (async) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xeeee0000, 0xa000, 0xdddd0000, 0xb000], 0x2000000db, 0xc}) (async) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0x4000, 0x4, 0x5, 0x0, 0x8, 0x3, 0xa, 0x7e, 0x4, 0x15, 0x5, 0x80204}, {0x804, 0x9, 0x1, 0x45, 0x7, 0x15, 0x4, 0x3, 0x0, 0xfe, 0x6, 0x7f, 0x20c}, {0x1, 0x3, 0x24, 0x5, 0x6, 0x7, 0x2, 0x50, 0xfd, 0x70, 0x4, 0x2}], 0xffbfffff}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) (async) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000024917720042322023f77010203010902120001000010000904"], 0x0) (async) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000340)={&(0x7f0000000300)=[{0x5, 0x92f5, 0x0, 0x0}, {0x7f, 0x1, 0x0, 0x0}], 0x2}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) add_key(&(0x7f0000002240)='dns_resolver\x00', &(0x7f0000002180)={'syz', 0x3}, &(0x7f0000000080)="ae", 0xfffff, 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000140)) (async) fcntl$setpipe(r5, 0x407, 0x0) (async) read$FUSE(r4, &(0x7f0000000900)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r5, &(0x7f0000004a40)={0x90, 0x0, r7, {0x5, 0x0, 0x8, 0xfffffffffffffffc, 0x3, 0xe, {0x3, 0x0, 0x6, 0xffffffffffffffff, 0x8000000000000001, 0x3, 0x752, 0x9, 0x0, 0xa000, 0x8, 0x0, 0x0, 0x1, 0x7}}}, 0x90) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r8, 0x1, 0x2e, &(0x7f0000000000)=r8, 0x4) recvmsg(r8, &(0x7f0000000f40)={0x0, 0x0, 0x0}, 0x40002002) r9 = socket$netlink(0x10, 0x3, 0x0) writev(r9, &(0x7f0000000140)=[{&(0x7f0000000000)="3900000013000b4700bb65e1c3e4ffff0100000040000000560000022500000019000a001000000007fd17e5ffff080004fe0000000000000a", 0x39}], 0x1) kernel console output (not intermixed with test programs): [ 425.146629][T11922] netlink: 140 bytes leftover after parsing attributes in process `syz.5.1561'. [ 425.219347][ T24] usb 6-1: USB disconnect, device number 68 [ 425.884427][T11944] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1567'. [ 425.950365][T11949] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1569'. [ 425.970611][T11949] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1569'. [ 426.015102][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.029256][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.131602][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 426.192548][T11948] FAULT_INJECTION: forcing a failure. [ 426.192548][T11948] name failslab, interval 1, probability 0, space 0, times 0 [ 426.243021][T11948] CPU: 0 UID: 0 PID: 11948 Comm: syz.1.1571 Tainted: G L syzkaller #0 PREEMPT(full) [ 426.243057][T11948] Tainted: [L]=SOFTLOCKUP [ 426.243064][T11948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 426.243077][T11948] Call Trace: [ 426.243092][T11948] [ 426.243098][T11948] dump_stack_lvl+0xe8/0x150 [ 426.243127][T11948] should_fail_ex+0x412/0x560 [ 426.243155][T11948] should_failslab+0xa8/0x100 [ 426.243178][T11948] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 426.243197][T11948] ? __alloc_skb+0x1d0/0x7d0 [ 426.243218][T11948] ? __local_bh_enable_ip+0xd0/0x130 [ 426.243246][T11948] __alloc_skb+0x1d0/0x7d0 [ 426.243266][T11948] ? netlink_ack_tlv_len+0x6c/0x210 [ 426.243291][T11948] netlink_ack+0x146/0xa50 [ 426.243310][T11948] ? __pfx_genl_rcv_msg+0x10/0x10 [ 426.243326][T11948] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 426.243340][T11948] ? __pfx_nl80211_post_doit+0x10/0x10 [ 426.243354][T11948] ? __pfx_ref_tracker_free+0x10/0x10 [ 426.243368][T11948] ? __asan_memcpy+0x40/0x70 [ 426.243383][T11948] ? __skb_clone+0x63/0x7a0 [ 426.243403][T11948] netlink_rcv_skb+0x2b6/0x4b0 [ 426.243425][T11948] ? __pfx_genl_rcv_msg+0x10/0x10 [ 426.243443][T11948] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 426.243481][T11948] ? down_read+0x270/0x2e0 [ 426.243501][T11948] ? genl_rcv+0xd/0x40 [ 426.243518][T11948] genl_rcv+0x28/0x40 [ 426.243551][T11948] netlink_unicast+0x75c/0x8e0 [ 426.243580][T11948] netlink_sendmsg+0x813/0xb40 [ 426.243609][T11948] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.243635][T11948] ? aa_sock_msg_perm+0xf1/0x1b0 [ 426.243651][T11948] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 426.243671][T11948] ____sys_sendmsg+0x972/0x9f0 [ 426.243686][T11948] ? __might_fault+0xaf/0x130 [ 426.243707][T11948] ? __pfx_____sys_sendmsg+0x10/0x10 [ 426.243728][T11948] ? import_iovec+0x73/0xa0 [ 426.243747][T11948] ___sys_sendmsg+0x2a5/0x360 [ 426.243761][T11948] ? __lock_acquire+0x6b5/0x2cf0 [ 426.243789][T11948] ? __pfx____sys_sendmsg+0x10/0x10 [ 426.243830][T11948] ? __fget_files+0x2a/0x420 [ 426.243846][T11948] ? __fget_files+0x3a0/0x420 [ 426.243869][T11948] __x64_sys_sendmsg+0x1bd/0x2a0 [ 426.243886][T11948] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 426.243908][T11948] ? __pfx_ksys_write+0x10/0x10 [ 426.243933][T11948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.243950][T11948] do_syscall_64+0x15f/0xf80 [ 426.243969][T11948] ? trace_irq_disable+0x3b/0x140 [ 426.243989][T11948] ? clear_bhb_loop+0x40/0x90 [ 426.244008][T11948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.244023][T11948] RIP: 0033:0x7f5a9c59c819 [ 426.244037][T11948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.244050][T11948] RSP: 002b:00007f5a9d4b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 426.244067][T11948] RAX: ffffffffffffffda RBX: 00007f5a9c815fa0 RCX: 00007f5a9c59c819 [ 426.244079][T11948] RDX: 0000000000000000 RSI: 0000200000002d00 RDI: 0000000000000004 [ 426.244088][T11948] RBP: 00007f5a9d4b6090 R08: 0000000000000000 R09: 0000000000000000 [ 426.244098][T11948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.244132][T11948] R13: 00007f5a9c816038 R14: 00007f5a9c815fa0 R15: 00007f5a9c93fa48 [ 426.244167][T11948] [ 426.954423][T11963] xt_TCPMSS: Only works on TCP SYN packets [ 427.086383][T11968] bond6: option ad_select: invalid value (253) [ 427.095382][T11968] bond6 (unregistering): Released all slaves [ 427.720070][ T807] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 427.755169][T11989] netlink: 'syz.1.1582': attribute type 4 has an invalid length. [ 427.898247][ T807] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 427.915952][ T807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.947591][ T807] usb 4-1: Product: syz [ 427.966089][ T807] usb 4-1: Manufacturer: syz [ 427.983380][ T807] usb 4-1: SerialNumber: syz [ 428.024703][ T807] usb 4-1: config 0 descriptor?? [ 428.051465][ T24] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 428.211512][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 428.243623][T11981] netlink: 140 bytes leftover after parsing attributes in process `syz.3.1580'. [ 428.257515][ T24] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 428.270681][T11994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.285972][ T10] usb 4-1: USB disconnect, device number 72 [ 428.315272][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 428.332029][ T24] usb 6-1: config 0 has no interface number 0 [ 428.333359][T11994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.404435][T11994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.432770][ T24] usb 6-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 428.434297][T11994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.464753][ T5899] udevd[5899]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 428.494389][T11994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.503532][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.513419][T11994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.545334][ T24] usb 6-1: Product: syz [ 428.553141][ T24] usb 6-1: Manufacturer: syz [ 428.581463][ T24] usb 6-1: SerialNumber: syz [ 428.606142][ T24] usb 6-1: config 0 descriptor?? [ 428.624308][ T24] uvcvideo 6-1:0.64: probe with driver uvcvideo failed with error -22 [ 428.733331][T11994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.756609][T11994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.060965][T11998] tipc: Enabled bearer , priority 0 [ 429.096021][T11998] syzkaller0: entered promiscuous mode [ 429.121870][T11998] syzkaller0: entered allmulticast mode [ 429.177866][T11998] tipc: Resetting bearer [ 429.208369][T11997] tipc: Resetting bearer [ 429.259782][T11997] tipc: Disabling bearer [ 429.298144][T12002] loop2: detected capacity change from 0 to 7 [ 429.350083][T12002] Dev loop2: unable to read RDB block 7 [ 429.377144][T12002] loop2: unable to read partition table [ 429.393630][T12002] loop2: partition table beyond EOD, truncated [ 429.412686][T12002] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 429.643845][T12009] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1589'. [ 429.687855][T12008] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1588'. [ 429.961532][ T10] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 430.081588][ T24] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 430.155979][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 14385, setting to 1024 [ 430.185023][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 430.212842][ T10] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 430.244735][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.263240][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 430.287498][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 430.300713][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 430.315019][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 430.325069][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 430.337147][ T24] usb 4-1: SerialNumber: syz [ 430.354793][ T10] usb 2-1: config 0 descriptor?? [ 430.368681][T12013] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 430.386058][ T24] cdc_mbim 4-1:1.0: MBIM functional descriptor missing [ 430.403889][ T24] cdc_mbim 4-1:1.0: bind() failure [ 430.627996][T12024] geneve2: entered promiscuous mode [ 430.763588][T12024] geneve2: entered allmulticast mode [ 430.777759][ T24] usb 4-1: USB disconnect, device number 73 [ 430.938372][T12029] loop3: detected capacity change from 0 to 7 [ 430.975756][T12029] Dev loop3: unable to read RDB block 7 [ 431.030785][T12029] loop3: AHDI p3 p4 [ 431.058263][T12029] loop3: partition table partially beyond EOD, truncated [ 431.118274][T12029] loop3: p3 start 1702000233 is beyond EOD, truncated [ 431.429781][ T24] usb 6-1: USB disconnect, device number 69 [ 431.514835][T12033] FAULT_INJECTION: forcing a failure. [ 431.514835][T12033] name failslab, interval 1, probability 0, space 0, times 0 [ 431.554047][T12033] CPU: 1 UID: 0 PID: 12033 Comm: syz.4.1597 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.554080][T12033] Tainted: [L]=SOFTLOCKUP [ 431.554089][T12033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 431.554101][T12033] Call Trace: [ 431.554109][T12033] [ 431.554117][T12033] dump_stack_lvl+0xe8/0x150 [ 431.554155][T12033] should_fail_ex+0x412/0x560 [ 431.554191][T12033] should_failslab+0xa8/0x100 [ 431.554218][T12033] ? skb_clone+0x212/0x3a0 [ 431.554239][T12033] kmem_cache_alloc_noprof+0x87/0x650 [ 431.554281][T12033] skb_clone+0x212/0x3a0 [ 431.554303][T12033] __netlink_deliver_tap+0x404/0x850 [ 431.554342][T12033] ? netlink_deliver_tap+0x2e/0x1b0 [ 431.554371][T12033] netlink_deliver_tap+0x19c/0x1b0 [ 431.554400][T12033] netlink_sendskb+0x68/0x140 [ 431.554426][T12033] netlink_rcv_skb+0x2b6/0x4b0 [ 431.554454][T12033] ? __pfx_genl_rcv_msg+0x10/0x10 [ 431.554477][T12033] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 431.554518][T12033] ? down_read+0x270/0x2e0 [ 431.554542][T12033] ? genl_rcv+0xd/0x40 [ 431.554564][T12033] genl_rcv+0x28/0x40 [ 431.554583][T12033] netlink_unicast+0x75c/0x8e0 [ 431.554618][T12033] netlink_sendmsg+0x813/0xb40 [ 431.554654][T12033] ? __pfx_netlink_sendmsg+0x10/0x10 [ 431.554685][T12033] ? aa_sock_msg_perm+0xf1/0x1b0 [ 431.554705][T12033] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 431.554731][T12033] ____sys_sendmsg+0x972/0x9f0 [ 431.554750][T12033] ? __might_fault+0xaf/0x130 [ 431.554780][T12033] ? __pfx_____sys_sendmsg+0x10/0x10 [ 431.554808][T12033] ? import_iovec+0x73/0xa0 [ 431.554839][T12033] ___sys_sendmsg+0x2a5/0x360 [ 431.554857][T12033] ? __lock_acquire+0x6b5/0x2cf0 [ 431.554889][T12033] ? __pfx____sys_sendmsg+0x10/0x10 [ 431.554940][T12033] ? __fget_files+0x2a/0x420 [ 431.554958][T12033] ? __fget_files+0x3a0/0x420 [ 431.554987][T12033] __x64_sys_sendmsg+0x1bd/0x2a0 [ 431.555009][T12033] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 431.555037][T12033] ? __pfx_ksys_write+0x10/0x10 [ 431.555068][T12033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.555089][T12033] do_syscall_64+0x15f/0xf80 [ 431.555110][T12033] ? trace_irq_disable+0x3b/0x140 [ 431.555135][T12033] ? clear_bhb_loop+0x40/0x90 [ 431.555158][T12033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.555176][T12033] RIP: 0033:0x7f566539c819 [ 431.555194][T12033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.555210][T12033] RSP: 002b:00007f566633c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 431.555230][T12033] RAX: ffffffffffffffda RBX: 00007f5665615fa0 RCX: 00007f566539c819 [ 431.555243][T12033] RDX: 0000000000000000 RSI: 0000200000002d00 RDI: 0000000000000004 [ 431.555255][T12033] RBP: 00007f566633c090 R08: 0000000000000000 R09: 0000000000000000 [ 431.555266][T12033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 431.555277][T12033] R13: 00007f5665616038 R14: 00007f5665615fa0 R15: 00007f566573fa48 [ 431.555307][T12033] [ 432.347609][T12044] program syz.5.1598 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 432.371492][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 432.471829][ T2173] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 432.641694][ T2173] usb 5-1: Using ep0 maxpacket: 16 [ 432.657502][ T2173] usb 5-1: config 127 has an invalid interface number: 124 but max is 0 [ 432.676596][ T2173] usb 5-1: config 127 has no interface number 0 [ 432.700766][ T2173] usb 5-1: config 127 interface 124 has no altsetting 0 [ 432.727250][T12049] loop2: detected capacity change from 0 to 7 [ 432.748451][ T2173] usb 5-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 432.768244][ T2173] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.778553][ T5913] usb 4-1: new low-speed USB device number 74 using dummy_hcd [ 432.812032][ T2173] usb 5-1: Product: syz [ 432.819106][T12049] Dev loop2: unable to read RDB block 7 [ 432.830325][ T2173] usb 5-1: Manufacturer: syz [ 432.842737][T12049] loop2: unable to read partition table [ 432.846347][ T2173] usb 5-1: SerialNumber: syz [ 432.865331][T12049] loop2: partition table beyond EOD, truncated [ 432.886909][T12049] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 432.931804][ T5913] usb 4-1: device descriptor read/64, error -71 [ 433.191999][ T5913] usb 4-1: new low-speed USB device number 75 using dummy_hcd [ 433.341957][ T5913] usb 4-1: device descriptor read/64, error -71 [ 433.482298][ T5913] usb usb4-port1: attempt power cycle [ 433.772234][ T2173] usb 5-1: reset high-speed USB device number 64 using dummy_hcd [ 433.872255][ T5913] usb 4-1: new low-speed USB device number 76 using dummy_hcd [ 433.934805][ T5913] usb 4-1: device descriptor read/8, error -71 [ 434.185139][T12041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.203703][ T5913] usb 4-1: new low-speed USB device number 77 using dummy_hcd [ 434.232159][T12041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.252302][ T5913] usb 4-1: device descriptor read/8, error -71 [ 434.338937][ T2173] usb 5-1: failed to restore interface 124 altsetting 11 (error=-71) [ 434.384031][ T2173] usb 5-1: USB disconnect, device number 64 [ 434.401665][ T5913] usb usb4-port1: unable to enumerate USB device [ 434.451491][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 435.133546][T12076] program syz.4.1608 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 436.079718][T12091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1611'. [ 436.112538][T12097] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1613'. [ 436.141677][T12097] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1613'. [ 436.213856][ T2173] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 436.305910][T12100] fuse: Bad value for 'fd' [ 436.426799][ T2173] usb 4-1: unable to get BOS descriptor or descriptor too short [ 436.447564][ T2173] usb 4-1: not running at top speed; connect to a high speed hub [ 436.483601][ T2173] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 128, changing to 4 [ 436.521077][ T2173] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 436.531536][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 436.568929][ T2173] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 255, changing to 4 [ 436.614431][ T2173] usb 4-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40 [ 436.638354][ T2173] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.668992][ T2173] usb 4-1: Product: syz [ 436.688056][ T2173] usb 4-1: Manufacturer: syz [ 436.710432][ T2173] usb 4-1: SerialNumber: syz [ 436.774919][T12107] netlink: 'syz.4.1615': attribute type 2 has an invalid length. [ 436.847479][T12107] netlink: 'syz.4.1615': attribute type 8 has an invalid length. [ 436.968887][T12107] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1615'. [ 437.234005][T12110] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1614'. [ 437.619987][ T2173] usb 4-1: 2:1 : no UAC_FORMAT_TYPE desc [ 437.851186][ T2173] usb 4-1: USB disconnect, device number 78 [ 437.990676][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 438.108233][T12119] netlink: 'syz.5.1619': attribute type 3 has an invalid length. [ 438.142945][T12119] netlink: 'syz.5.1619': attribute type 3 has an invalid length. [ 438.178224][T12119] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1619'. [ 438.263668][T12122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.302003][T12122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.408747][T12124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1621'. [ 438.431527][T12122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.442424][T12124] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1621'. [ 438.467765][T12122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.491414][ T2173] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 438.510295][T12122] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1620'. [ 438.611513][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 438.653912][ T2173] usb 6-1: config 0 has an invalid interface number: 120 but max is 0 [ 438.680705][ T2173] usb 6-1: config 0 has no interface number 0 [ 438.704783][ T2173] usb 6-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xF1, changing to 0x81 [ 438.743081][ T2173] usb 6-1: config 0 interface 120 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.781659][ T2173] usb 6-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 438.812942][ T2173] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.852961][ T2173] usb 6-1: config 0 descriptor?? [ 438.884991][ T2173] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.120/input/input26 [ 439.002323][T12131] erspan0: entered promiscuous mode [ 439.083515][T12119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.112488][T12119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.144044][ T2173] usb 6-1: USB disconnect, device number 70 [ 439.455458][T12133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.465623][T12133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.894613][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.901842][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.982102][T12142] loop2: detected capacity change from 0 to 7 [ 440.013780][T12142] Dev loop2: unable to read RDB block 7 [ 440.041125][T12142] loop2: unable to read partition table [ 440.071851][T12142] loop2: partition table beyond EOD, truncated [ 440.082036][ T2173] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 440.103273][T12142] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 440.253792][ T2173] usb 6-1: unable to get BOS descriptor or descriptor too short [ 440.285182][ T2173] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 440.325189][ T2173] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 440.364217][ T2173] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 440.415053][ T2173] usb 6-1: string descriptor 0 read error: -22 [ 440.436088][ T2173] usb 6-1: New USB device found, idVendor=04b4, idProduct=0384, bcdDevice= 0.40 [ 440.467317][ T2173] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.550424][ T2173] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 440.691533][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 440.774835][ T2173] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 440.856923][ T2173] snd-usb-hiface 6-1:1.0: probe with driver snd-usb-hiface failed with error -22 [ 441.107244][ T807] usb 6-1: USB disconnect, device number 71 [ 442.541550][ T807] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 442.701557][ T807] usb 6-1: Using ep0 maxpacket: 16 [ 442.709633][ T807] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 442.744370][ T807] usb 6-1: config 0 has no interface number 0 [ 442.767399][ T807] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 442.777541][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 442.833733][ T807] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 442.873931][ T807] usb 6-1: config 0 interface 41 has no altsetting 0 [ 442.895645][ T807] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 442.909810][ T807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.961097][ T807] usb 6-1: Product: syz [ 442.986106][ T807] usb 6-1: Manufacturer: syz [ 443.001430][ T807] usb 6-1: SerialNumber: syz [ 443.027502][ T807] usb 6-1: config 0 descriptor?? [ 443.062088][T12161] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 443.072392][T12161] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 443.334412][T12161] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 443.366680][T12161] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 443.520257][T12164] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 443.829197][T12161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.868941][T12161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.235581][ T807] sr9700 6-1:0.41 eth5: register 'sr9700' at usb-dummy_hcd.5-1, CoreChip SR9700 USB Ethernet, 56:f0:2d:89:de:43 [ 444.305227][ T807] usb 6-1: USB disconnect, device number 72 [ 444.349507][ T807] sr9700 6-1:0.41 eth5: unregister 'sr9700' usb-dummy_hcd.5-1, CoreChip SR9700 USB Ethernet [ 444.399573][ T29] kauditd_printk_skb: 39 callbacks suppressed [ 444.399594][ T29] audit: type=1326 audit(1776829177.850:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12173 comm="syz.3.1638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 444.450534][ T29] audit: type=1326 audit(1776829177.850:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12173 comm="syz.3.1638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 444.567400][ T29] audit: type=1326 audit(1776829177.850:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12173 comm="syz.3.1638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f15a795957b code=0x7ffc0000 [ 444.723194][ T29] audit: type=1326 audit(1776829177.850:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12173 comm="syz.3.1638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 444.813833][T12185] tipc: Enabled bearer , priority 0 [ 444.835096][T12185] syzkaller0: entered promiscuous mode [ 444.844604][T12185] syzkaller0: entered allmulticast mode [ 444.851530][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 444.949716][T12185] tipc: Resetting bearer [ 444.984719][T12180] tipc: Resetting bearer [ 445.074510][T12180] tipc: Disabling bearer [ 445.291483][ T807] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 445.464302][ T807] usb 6-1: Using ep0 maxpacket: 32 [ 445.516033][ T807] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 445.535630][ T807] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 445.549126][ T807] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 445.605137][ T807] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 445.638157][ T807] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 445.694717][ T807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.827705][ T807] usb 6-1: Product: syz [ 445.837816][ T807] usb 6-1: Manufacturer: syz [ 445.848346][ T807] usb 6-1: SerialNumber: syz [ 445.970536][ C1] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 446.012662][ T807] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/input/input27 [ 446.282569][ T807] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 446.321873][ T807] (id 0x00) [ 446.731900][ T807] rc_core: IR keymap rc-imon-pad not found [ 446.759689][ T807] Registered IR keymap rc-empty [ 446.772955][ T24] usb 5-1: new full-speed USB device number 65 using dummy_hcd [ 446.799060][ T807] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 446.837693][ T807] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 446.903008][ T807] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0 [ 446.931731][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 446.971278][ T24] usb 5-1: device descriptor read/64, error -71 [ 446.992081][ T807] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0/input28 [ 447.096861][ T807] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:73> initialized [ 447.166293][T12226] netlink: 658 bytes leftover after parsing attributes in process `syz.3.1648'. [ 447.242492][ T24] usb 5-1: new full-speed USB device number 66 using dummy_hcd [ 447.423773][ T24] usb 5-1: device descriptor read/64, error -71 [ 447.565745][ T24] usb usb5-port1: attempt power cycle [ 447.933835][ T24] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 447.983875][ T24] usb 5-1: device descriptor read/8, error -71 [ 448.242152][ T24] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 448.274107][ T24] usb 5-1: device descriptor read/8, error -71 [ 448.391913][ T24] usb usb5-port1: unable to enumerate USB device [ 448.401349][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 448.846209][T12254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.886319][T12254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.902399][T12256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1654'. [ 448.917601][T12256] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1654'. [ 449.011539][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 449.061155][T12195] imon:send_packet: task interrupted [ 449.102533][T12195] imon:send_packet: packet tx failed (-512) [ 449.143090][T12195] imon:vfd_write: send packet #1 failed [ 449.243082][T12235] imon:display_open: display port is already open [ 449.378458][ T29] audit: type=1326 audit(1776829182.830:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 449.493858][ T29] audit: type=1326 audit(1776829182.860:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 449.593793][T12265] netlink: 'syz.1.1657': attribute type 10 has an invalid length. [ 449.632296][ T29] audit: type=1326 audit(1776829182.860:742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5a9c55d04e code=0x7ffc0000 [ 449.687743][T12265] macvlan1: entered allmulticast mode [ 449.752936][T12265] veth1_vlan: entered allmulticast mode [ 449.766855][ T29] audit: type=1326 audit(1776829182.860:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 449.841616][T12265] team0: Port device macvlan1 added [ 449.888843][ T29] audit: type=1326 audit(1776829182.860:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 449.993934][ T29] audit: type=1326 audit(1776829182.860:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=20 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 450.081606][ T29] audit: type=1326 audit(1776829182.880:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 450.182736][ T29] audit: type=1326 audit(1776829182.890:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5a9c55d04e code=0x7ffc0000 [ 450.238085][ T807] usb 6-1: USB disconnect, device number 73 [ 450.294980][ T29] audit: type=1326 audit(1776829182.890:748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 450.397418][ T29] audit: type=1326 audit(1776829182.890:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 450.445251][ T29] audit: type=1326 audit(1776829182.900:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12264 comm="syz.1.1657" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 450.534891][T12284] loop2: detected capacity change from 0 to 7 [ 450.547921][T12284] Dev loop2: unable to read RDB block 7 [ 450.573086][T12284] loop2: unable to read partition table [ 450.591820][T12284] loop2: partition table beyond EOD, truncated [ 450.614568][T12284] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 450.943272][T12296] netlink: 'syz.4.1664': attribute type 1 has an invalid length. [ 451.049155][T12296] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1664'. [ 451.091778][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 451.721517][ T807] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 451.916006][ T807] usb 5-1: Using ep0 maxpacket: 32 [ 451.946411][ T807] usb 5-1: config index 0 descriptor too short (expected 6701, got 45) [ 452.038340][ T807] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 452.210538][ T807] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 452.254707][ T807] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 452.312883][ T807] usb 5-1: config 0 interface 0 has no altsetting 0 [ 452.347199][ T807] usb 5-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.9d [ 452.378382][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.413567][ T807] usb 5-1: config 0 descriptor?? [ 452.877703][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 452.907312][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 452.939723][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 452.958533][T12319] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1671'. [ 452.986201][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 453.017089][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 453.035217][T12319] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1671'. [ 453.087638][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 453.112559][ T807] logitech 0003:046D:CA03.0016: unknown main item tag 0x0 [ 453.154806][ T807] logitech 0003:046D:CA03.0016: hidraw0: USB HID v0.00 Device [HID 046d:ca03] on usb-dummy_hcd.4-1/input0 [ 453.172795][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 453.218702][ T807] logitech 0003:046D:CA03.0016: no inputs found [ 453.304993][ T807] usb 5-1: USB disconnect, device number 69 [ 453.482927][T12323] fido_id[12323]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 453.885086][T12321] trusted_key: syz.1.1672 sent an empty control message without MSG_MORE. [ 454.327551][T12330] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1675'. [ 454.336828][T12330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1675'. [ 454.456404][T12333] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1676'. [ 454.733658][T12339] loop2: detected capacity change from 0 to 7 [ 454.787256][T12339] Dev loop2: unable to read RDB block 7 [ 454.827076][T12339] loop2: unable to read partition table [ 454.862571][T12339] loop2: partition table beyond EOD, truncated [ 454.895784][T12339] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 455.172053][ T5855] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 455.251515][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 455.379220][ T5855] usb 4-1: unable to get BOS descriptor or descriptor too short [ 455.406164][T12361] kAFS: unable to lookup cell '(,c' [ 455.435424][ T5855] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 254, changing to 7 [ 455.493024][ T5855] usb 4-1: New USB device found, idVendor=1235, idProduct=8210, bcdDevice= 0.40 [ 455.555432][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.608187][ T5855] usb 4-1: Product: syz [ 455.632904][ T5855] usb 4-1: Manufacturer: syz [ 455.659802][ T5855] usb 4-1: SerialNumber: syz [ 455.957590][ T5855] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 456.013921][ T5855] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 456.046533][ T5855] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 456.305667][ T5855] usb 4-1: USB disconnect, device number 79 [ 456.374304][T12373] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.1689'. [ 457.199034][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.290175][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.331488][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 457.368191][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.411554][ T5855] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 457.441837][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.533095][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.570401][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.599409][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.615566][ T5855] usb 4-1: Using ep0 maxpacket: 16 [ 457.641289][ T5855] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 457.668935][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.701206][ T5855] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 457.750573][ T5855] usb 4-1: config 0 interface 0 has no altsetting 0 [ 457.774258][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.789674][ T5855] usb 4-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 457.824307][T12385] netlink: 'syz.5.1692': attribute type 5 has an invalid length. [ 457.857212][T12388] loop2: detected capacity change from 0 to 7 [ 457.870158][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.909205][T12388] Dev loop2: unable to read RDB block 7 [ 457.911223][ T5855] usb 4-1: Product: syz [ 457.953122][ T5855] usb 4-1: Manufacturer: syz [ 457.953331][T12388] loop2: unable to read partition table [ 457.987381][T12388] loop2: partition table beyond EOD, truncated [ 457.989111][ T5855] usb 4-1: SerialNumber: syz [ 458.029349][T12388] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 458.096020][ T5855] usb 4-1: config 0 descriptor?? [ 458.399356][ T5855] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input29 [ 458.911991][T12399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.962521][ T807] usb 4-1: USB disconnect, device number 80 [ 458.976642][ T5195] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -19 [ 459.005301][T12399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.050795][ T5195] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -19 [ 459.094571][T12400] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1698'. [ 459.115894][T12399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.158729][T12399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.331618][ T5855] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 459.411520][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 459.502026][ T5855] usb 6-1: Using ep0 maxpacket: 32 [ 459.508559][T12410] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.1701'. [ 459.520505][ T5855] usb 6-1: config 2 has an invalid interface number: 88 but max is 0 [ 459.539283][ T5855] usb 6-1: config 2 has no interface number 0 [ 459.559661][ T5855] usb 6-1: config 2 interface 88 has no altsetting 0 [ 459.584814][ T5855] usb 6-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 459.607093][ T5855] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.641630][ T5855] usb 6-1: Product: syz [ 459.653983][ T5855] usb 6-1: Manufacturer: syz [ 459.669028][ T5855] usb 6-1: SerialNumber: syz [ 459.988865][T12422] fuse: Bad value for 'user_id' [ 460.032412][T12422] fuse: Bad value for 'user_id' [ 460.159827][T12425] bond10: entered promiscuous mode [ 460.166468][T12425] bond10: entered allmulticast mode [ 460.172786][T12425] 8021q: adding VLAN 0 to HW filter on device bond10 [ 460.500616][ T5855] asix 6-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 460.532258][ T5855] asix 6-1:2.88: probe with driver asix failed with error -71 [ 460.583129][ T5855] usb 6-1: USB disconnect, device number 74 [ 460.760006][T12434] binder: 12433:12434 ioctl 4018620d 0 returned -22 [ 460.818717][T12434] binder: 12433:12434 ioctl c0306201 200000001440 returned -11 [ 460.962064][T12436] fuse: Bad value for 'fd' [ 460.999917][T12436] fuse: Bad value for 'fd' [ 461.229637][T12444] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1710'. [ 461.266065][T12449] FAULT_INJECTION: forcing a failure. [ 461.266065][T12449] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 461.292086][T12446] binder: 12443:12446 ioctl c0405610 200000000040 returned -22 [ 461.326535][T12449] CPU: 1 UID: 0 PID: 12449 Comm: syz.4.1712 Tainted: G L syzkaller #0 PREEMPT(full) [ 461.326560][T12449] Tainted: [L]=SOFTLOCKUP [ 461.326565][T12449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 461.326574][T12449] Call Trace: [ 461.326580][T12449] [ 461.326587][T12449] dump_stack_lvl+0xe8/0x150 [ 461.326614][T12449] should_fail_ex+0x412/0x560 [ 461.326640][T12449] _copy_from_user+0x2d/0xb0 [ 461.326656][T12449] snd_seq_oss_write+0x5b1/0x8f0 [ 461.326675][T12449] ? get_pid_task+0x20/0x1f0 [ 461.326704][T12449] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 461.326724][T12449] ? apparmor_file_permission+0x1f4/0x300 [ 461.326746][T12449] ? security_file_permission+0x75/0x260 [ 461.326768][T12449] odev_write+0x5a/0x80 [ 461.326782][T12449] ? __pfx_odev_write+0x10/0x10 [ 461.326798][T12449] vfs_write+0x29a/0xb90 [ 461.326821][T12449] ? __pfx_vfs_write+0x10/0x10 [ 461.326839][T12449] ? __fget_files+0x2a/0x420 [ 461.326855][T12449] ? __fget_files+0x2a/0x420 [ 461.326868][T12449] ? __fget_files+0x3a0/0x420 [ 461.326899][T12449] ? __fget_files+0x2a/0x420 [ 461.326931][T12449] ksys_write+0x150/0x270 [ 461.326950][T12449] ? __pfx_ksys_write+0x10/0x10 [ 461.326973][T12449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.326988][T12449] do_syscall_64+0x15f/0xf80 [ 461.327005][T12449] ? trace_irq_disable+0x3b/0x140 [ 461.327024][T12449] ? clear_bhb_loop+0x40/0x90 [ 461.327041][T12449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.327055][T12449] RIP: 0033:0x7f566539c819 [ 461.327068][T12449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.327081][T12449] RSP: 002b:00007f566633c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 461.327096][T12449] RAX: ffffffffffffffda RBX: 00007f5665615fa0 RCX: 00007f566539c819 [ 461.327107][T12449] RDX: 0000000000000010 RSI: 0000200000000200 RDI: 0000000000000003 [ 461.327116][T12449] RBP: 00007f566633c090 R08: 0000000000000000 R09: 0000000000000000 [ 461.327125][T12449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.327133][T12449] R13: 00007f5665616038 R14: 00007f5665615fa0 R15: 00007f566573fa48 [ 461.327154][T12449] [ 461.551856][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 461.809377][T12455] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.1713'. [ 462.441641][ T807] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 462.641498][ T807] usb 5-1: Using ep0 maxpacket: 8 [ 462.652753][ T807] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.673035][ T807] usb 5-1: too many endpoints for config 0 interface 0 altsetting 41: 36, using maximum allowed: 30 [ 462.691853][ T5855] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 462.710497][ T807] usb 5-1: config 0 interface 0 altsetting 41 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 462.746626][ T807] usb 5-1: config 0 interface 0 altsetting 41 endpoint 0x81 has invalid wMaxPacketSize 0 [ 462.773381][ T807] usb 5-1: config 0 interface 0 altsetting 41 has 1 endpoint descriptor, different from the interface descriptor's value: 36 [ 462.812642][ T807] usb 5-1: config 0 interface 0 has no altsetting 0 [ 462.854661][ T807] usb 5-1: New USB device found, idVendor=06cb, idProduct=73f5, bcdDevice=b5.00 [ 462.866552][ T807] usb 5-1: New USB device strings: Mfr=43, Product=0, SerialNumber=0 [ 462.881952][ T807] usb 5-1: Manufacturer: syz [ 462.892367][ T807] usb 5-1: config 0 descriptor?? [ 462.917524][ T5855] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 462.958685][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.001007][ T5855] usb 4-1: Product: syz [ 463.026787][ T5855] usb 4-1: Manufacturer: syz [ 463.052196][ T5855] usb 4-1: SerialNumber: syz [ 463.328731][T12473] FAULT_INJECTION: forcing a failure. [ 463.328731][T12473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 463.369263][T12473] CPU: 1 UID: 0 PID: 12473 Comm: syz.1.1717 Tainted: G L syzkaller #0 PREEMPT(full) [ 463.369299][T12473] Tainted: [L]=SOFTLOCKUP [ 463.369308][T12473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 463.369323][T12473] Call Trace: [ 463.369331][T12473] [ 463.369342][T12473] dump_stack_lvl+0xe8/0x150 [ 463.369385][T12473] should_fail_ex+0x412/0x560 [ 463.369425][T12473] _copy_from_iter+0x1d3/0x1670 [ 463.369452][T12473] ? rcu_is_watching+0x15/0xb0 [ 463.369481][T12473] ? __pfx__copy_from_iter+0x10/0x10 [ 463.369512][T12473] ? netlink_sendmsg+0x650/0xb40 [ 463.369553][T12473] ? skb_put+0x11b/0x210 [ 463.369590][T12473] netlink_sendmsg+0x6c0/0xb40 [ 463.369633][T12473] ? __pfx_netlink_sendmsg+0x10/0x10 [ 463.369669][T12473] ? aa_sock_msg_perm+0xf1/0x1b0 [ 463.369694][T12473] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 463.369724][T12473] ____sys_sendmsg+0x972/0x9f0 [ 463.369747][T12473] ? __might_fault+0xaf/0x130 [ 463.369777][T12473] ? __pfx_____sys_sendmsg+0x10/0x10 [ 463.369807][T12473] ? import_iovec+0x73/0xa0 [ 463.369835][T12473] ___sys_sendmsg+0x2a5/0x360 [ 463.369856][T12473] ? __lock_acquire+0x6b5/0x2cf0 [ 463.369893][T12473] ? __pfx____sys_sendmsg+0x10/0x10 [ 463.369951][T12473] ? __fget_files+0x2a/0x420 [ 463.369974][T12473] ? __fget_files+0x3a0/0x420 [ 463.370008][T12473] __x64_sys_sendmsg+0x1bd/0x2a0 [ 463.370035][T12473] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 463.370068][T12473] ? __pfx_ksys_write+0x10/0x10 [ 463.370104][T12473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.370129][T12473] do_syscall_64+0x15f/0xf80 [ 463.370157][T12473] ? trace_irq_disable+0x3b/0x140 [ 463.370187][T12473] ? clear_bhb_loop+0x40/0x90 [ 463.370226][T12473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.370247][T12473] RIP: 0033:0x7f5a9c59c819 [ 463.370269][T12473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 463.370288][T12473] RSP: 002b:00007f5a9d4b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 463.370312][T12473] RAX: ffffffffffffffda RBX: 00007f5a9c815fa0 RCX: 00007f5a9c59c819 [ 463.370329][T12473] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 463.370343][T12473] RBP: 00007f5a9d4b6090 R08: 0000000000000000 R09: 0000000000000000 [ 463.370368][T12473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 463.370380][T12473] R13: 00007f5a9c816038 R14: 00007f5a9c815fa0 R15: 00007f5a9c93fa48 [ 463.370411][T12473] [ 463.617610][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 463.687634][ T807] usbhid 5-1:0.0: can't add hid device: -71 [ 463.693743][ T807] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 463.704325][ T807] usb 5-1: USB disconnect, device number 70 [ 463.827345][T12467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.883442][T12476] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.885213][T12467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.893773][T12476] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.987593][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 464.026739][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 464.071294][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 464.133705][ T5855] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 464.179532][T12478] bond8: entered promiscuous mode [ 464.202452][ T5855] usb 4-1: USB disconnect, device number 81 [ 464.208528][T12478] bond8: entered allmulticast mode [ 464.233548][T12478] 8021q: adding VLAN 0 to HW filter on device bond8 [ 464.776084][T12491] FAULT_INJECTION: forcing a failure. [ 464.776084][T12491] name failslab, interval 1, probability 0, space 0, times 0 [ 464.868877][T12491] CPU: 1 UID: 0 PID: 12491 Comm: syz.1.1722 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.868913][T12491] Tainted: [L]=SOFTLOCKUP [ 464.868922][T12491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 464.868935][T12491] Call Trace: [ 464.868944][T12491] [ 464.868954][T12491] dump_stack_lvl+0xe8/0x150 [ 464.868994][T12491] should_fail_ex+0x412/0x560 [ 464.869052][T12491] should_failslab+0xa8/0x100 [ 464.869085][T12491] __kmalloc_noprof+0xe8/0x760 [ 464.869111][T12491] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 464.869144][T12491] tomoyo_realpath_from_path+0xe3/0x5d0 [ 464.869170][T12491] ? tomoyo_domain+0xd7/0x130 [ 464.869200][T12491] ? tomoyo_path_number_perm+0x219/0x630 [ 464.869232][T12491] tomoyo_path_number_perm+0x246/0x630 [ 464.869267][T12491] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 464.869297][T12491] ? __lock_acquire+0x6b5/0x2cf0 [ 464.869346][T12491] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 464.869407][T12491] ? __fget_files+0x2a/0x420 [ 464.869433][T12491] ? __fget_files+0x2a/0x420 [ 464.869453][T12491] ? __fget_files+0x3a0/0x420 [ 464.869475][T12491] ? __fget_files+0x2a/0x420 [ 464.869502][T12491] security_file_ioctl+0xc3/0x2a0 [ 464.869534][T12491] __se_sys_ioctl+0x47/0x170 [ 464.869564][T12491] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.869588][T12491] do_syscall_64+0x15f/0xf80 [ 464.869614][T12491] ? trace_irq_disable+0x3b/0x140 [ 464.869643][T12491] ? clear_bhb_loop+0x40/0x90 [ 464.869670][T12491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.869692][T12491] RIP: 0033:0x7f5a9c59c819 [ 464.869713][T12491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 464.869733][T12491] RSP: 002b:00007f5a9d4b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 464.869760][T12491] RAX: ffffffffffffffda RBX: 00007f5a9c815fa0 RCX: 00007f5a9c59c819 [ 464.869777][T12491] RDX: 0000200000000100 RSI: 0000000000004601 RDI: 0000000000000003 [ 464.869791][T12491] RBP: 00007f5a9d4b6090 R08: 0000000000000000 R09: 0000000000000000 [ 464.869806][T12491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.869819][T12491] R13: 00007f5a9c816038 R14: 00007f5a9c815fa0 R15: 00007f5a9c93fa48 [ 464.869854][T12491] [ 465.111733][T12491] ERROR: Out of memory at tomoyo_realpath_from_path. [ 465.137673][T12496] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.1724'. [ 465.298702][ T807] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 465.455866][ T807] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 465.468130][ T807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.506968][ T807] usb 5-1: Product: syz [ 465.519856][ T807] usb 5-1: Manufacturer: syz [ 465.535776][ T807] usb 5-1: SerialNumber: syz [ 465.559257][T12502] tipc: Enabled bearer , priority 0 [ 465.651477][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 465.684316][T12503] syzkaller0: entered promiscuous mode [ 465.742243][T12503] syzkaller0: entered allmulticast mode [ 465.864985][T12500] tipc: Resetting bearer [ 465.931147][T12515] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1729'. [ 465.952990][T12500] tipc: Disabling bearer [ 466.191510][ T24] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 466.351073][T12525] loop2: detected capacity change from 0 to 7 [ 466.352919][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 466.369601][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.388381][ T24] usb 4-1: New USB device found, idVendor=0421, idProduct=798f, bcdDevice=86.54 [ 466.402137][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.410904][ T24] usb 4-1: Product: syz [ 466.415672][ T24] usb 4-1: Manufacturer: syz [ 466.420366][ T24] usb 4-1: SerialNumber: syz [ 466.433752][ T24] usb 4-1: config 0 descriptor?? [ 466.451614][T12525] Dev loop2: unable to read RDB block 7 [ 466.459673][T12522] bond9: entered promiscuous mode [ 466.479951][ T24] cdc_phonet 4-1:0.0: probe with driver cdc_phonet failed with error -22 [ 466.496520][T12525] loop2: unable to read partition table [ 466.501877][T12522] bond9: entered allmulticast mode [ 466.526283][T12525] loop2: partition table beyond EOD, truncated [ 466.550973][T12522] 8021q: adding VLAN 0 to HW filter on device bond9 [ 466.571631][T12525] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 466.873738][T12528] sctp: [Deprecated]: syz.3.1729 (pid 12528) Use of struct sctp_assoc_value in delayed_ack socket option. [ 466.873738][T12528] Use struct sctp_sack_info instead [ 467.655886][T12540] syzkaller0: entered promiscuous mode [ 467.690132][T12540] syzkaller0: entered allmulticast mode [ 467.731505][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 467.792522][ T24] usb 4-1: USB disconnect, device number 82 [ 468.433202][ T24] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 468.653008][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 468.688423][ T24] usb 4-1: config 0 has an invalid interface number: 186 but max is 0 [ 468.743768][ T24] usb 4-1: config 0 has no interface number 0 [ 468.771350][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 468.871864][ T24] usb 4-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 468.964009][ T24] usb 4-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 469.135943][ T24] usb 4-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 469.258405][ T807] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 469.274694][ T24] usb 4-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 469.333185][T12554] FAULT_INJECTION: forcing a failure. [ 469.333185][T12554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.374452][ T807] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 469.378402][T12554] CPU: 0 UID: 0 PID: 12554 Comm: syz.5.1741 Tainted: G L syzkaller #0 PREEMPT(full) [ 469.378483][T12554] Tainted: [L]=SOFTLOCKUP [ 469.378505][T12554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 469.378547][T12554] Call Trace: [ 469.378570][T12554] [ 469.378594][T12554] dump_stack_lvl+0xe8/0x150 [ 469.378721][T12554] should_fail_ex+0x412/0x560 [ 469.378842][T12554] strncpy_from_user+0x36/0x2b0 [ 469.378950][T12554] do_getname+0x77/0x250 [ 469.379063][T12554] path_listxattrat+0xd9/0x3f0 [ 469.379144][T12554] ? __pfx_path_listxattrat+0x10/0x10 [ 469.379256][T12554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.379321][T12554] do_syscall_64+0x15f/0xf80 [ 469.379391][T12554] ? trace_irq_disable+0x3b/0x140 [ 469.379475][T12554] ? clear_bhb_loop+0x40/0x90 [ 469.379542][T12554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.379605][T12554] RIP: 0033:0x7f742199c819 [ 469.379662][T12554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.379717][T12554] RSP: 002b:00007f742287a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 469.379786][T12554] RAX: ffffffffffffffda RBX: 00007f7421c15fa0 RCX: 00007f742199c819 [ 469.379831][T12554] RDX: 00000000000000f1 RSI: 0000200000000340 RDI: 0000200000000040 [ 469.379875][T12554] RBP: 00007f742287a090 R08: 0000000000000000 R09: 0000000000000000 [ 469.379916][T12554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.379950][T12554] R13: 00007f7421c16038 R14: 00007f7421c15fa0 R15: 00007f7421d3fa48 [ 469.380039][T12554] [ 469.549366][ T24] usb 4-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 469.616801][ T24] usb 4-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 469.635288][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.644877][ T24] usb 4-1: Product: syz [ 469.649137][ T24] usb 4-1: Manufacturer: syz [ 469.654051][ T24] usb 4-1: SerialNumber: syz [ 469.675038][ T24] usb 4-1: config 0 descriptor?? [ 469.681282][ T807] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 469.705516][ T807] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 469.776045][ T807] usb 5-1: USB disconnect, device number 71 [ 469.811584][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 469.909641][ T24] iowarrior 4-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 470.091032][T12565] tipc: New replicast peer: 255.255.255.255 [ 470.100115][T12565] tipc: Enabled bearer , priority 10 [ 470.145949][ C1] iowarrior 4-1:0.186: iowarrior_callback - usb_submit_urb failed with result -1 [ 470.165420][ T5913] usb 4-1: USB disconnect, device number 83 [ 470.181690][ T807] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 470.364419][ T807] usb 5-1: Using ep0 maxpacket: 32 [ 470.397301][ T807] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 470.411788][ T807] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 470.438797][T12570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1746'. [ 470.448542][ T807] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 470.474668][ T807] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 470.509471][ T807] usb 5-1: config 0 interface 0 has no altsetting 0 [ 470.518416][T12571] FAULT_INJECTION: forcing a failure. [ 470.518416][T12571] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.535955][ T807] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 470.548800][ T807] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 470.558009][ T807] usb 5-1: Product: syz [ 470.563169][ T807] usb 5-1: Manufacturer: syz [ 470.568123][ T807] usb 5-1: SerialNumber: syz [ 470.577113][ T807] usb 5-1: config 0 descriptor?? [ 470.599879][T12571] CPU: 0 UID: 0 PID: 12571 Comm: syz.5.1745 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.599904][T12571] Tainted: [L]=SOFTLOCKUP [ 470.599910][T12571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 470.599920][T12571] Call Trace: [ 470.599926][T12571] [ 470.599933][T12571] dump_stack_lvl+0xe8/0x150 [ 470.599961][T12571] should_fail_ex+0x412/0x560 [ 470.599990][T12571] _copy_from_user+0x2d/0xb0 [ 470.600008][T12571] ___sys_sendmsg+0x1c6/0x360 [ 470.600024][T12571] ? __lock_acquire+0x6b5/0x2cf0 [ 470.600050][T12571] ? __pfx____sys_sendmsg+0x10/0x10 [ 470.600090][T12571] ? __fget_files+0x2a/0x420 [ 470.600105][T12571] ? __fget_files+0x3a0/0x420 [ 470.600127][T12571] __x64_sys_sendmsg+0x1bd/0x2a0 [ 470.600145][T12571] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 470.600180][T12571] ? __pfx_ksys_write+0x10/0x10 [ 470.600204][T12571] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.600233][T12571] do_syscall_64+0x15f/0xf80 [ 470.600250][T12571] ? trace_irq_disable+0x3b/0x140 [ 470.600269][T12571] ? clear_bhb_loop+0x40/0x90 [ 470.600286][T12571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.600299][T12571] RIP: 0033:0x7f742199c819 [ 470.600313][T12571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.600325][T12571] RSP: 002b:00007f742287a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 470.600340][T12571] RAX: ffffffffffffffda RBX: 00007f7421c15fa0 RCX: 00007f742199c819 [ 470.600351][T12571] RDX: 0000000020000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 470.600360][T12571] RBP: 00007f742287a090 R08: 0000000000000000 R09: 0000000000000000 [ 470.600369][T12571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.600377][T12571] R13: 00007f7421c16038 R14: 00007f7421c15fa0 R15: 00007f7421d3fa48 [ 470.600398][T12571] [ 470.792102][ T807] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 470.805978][ T807] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 470.982521][ T807] usb 5-1: USB disconnect, device number 72 [ 471.022680][T12576] Invalid option length (57448) for dns_resolver key [ 471.058098][ T807] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 471.174847][T12582] kAFS: unable to lookup cell '' [ 471.236386][T12587] kAFS: unable to lookup cell '(,c' [ 471.275687][T12588] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1750'. [ 471.285434][T12588] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1750'. [ 471.430913][T12594] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1752'. [ 471.490976][T12594] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1752'. [ 471.541417][ T807] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 471.679163][T12602] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1753'. [ 471.688370][ T807] usb 4-1: device descriptor read/64, error -71 [ 471.781569][T12604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1755'. [ 471.811648][T12604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1755'. [ 471.846762][T12608] FAULT_INJECTION: forcing a failure. [ 471.846762][T12608] name failslab, interval 1, probability 0, space 0, times 0 [ 471.861136][T12605] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1753'. [ 471.871123][T12608] CPU: 1 UID: 0 PID: 12608 Comm: syz.4.1756 Tainted: G L syzkaller #0 PREEMPT(full) [ 471.871153][T12608] Tainted: [L]=SOFTLOCKUP [ 471.871160][T12608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 471.871173][T12608] Call Trace: [ 471.871182][T12608] [ 471.871190][T12608] dump_stack_lvl+0xe8/0x150 [ 471.871227][T12608] should_fail_ex+0x412/0x560 [ 471.871263][T12608] should_failslab+0xa8/0x100 [ 471.871292][T12608] __kvmalloc_node_noprof+0x178/0x8a0 [ 471.871320][T12608] ? listxattr+0x51/0x2a0 [ 471.871358][T12608] listxattr+0x51/0x2a0 [ 471.871386][T12608] path_listxattrat+0x1a3/0x3f0 [ 471.871415][T12608] ? __pfx_path_listxattrat+0x10/0x10 [ 471.871450][T12608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.871472][T12608] do_syscall_64+0x15f/0xf80 [ 471.871496][T12608] ? trace_irq_disable+0x3b/0x140 [ 471.871523][T12608] ? clear_bhb_loop+0x40/0x90 [ 471.871546][T12608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.871566][T12608] RIP: 0033:0x7f566539c819 [ 471.871584][T12608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.871601][T12608] RSP: 002b:00007f566633c028 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2 [ 471.871622][T12608] RAX: ffffffffffffffda RBX: 00007f5665615fa0 RCX: 00007f566539c819 [ 471.871637][T12608] RDX: 00000000000000f1 RSI: 0000200000000340 RDI: 0000200000000040 [ 471.871651][T12608] RBP: 00007f566633c090 R08: 0000000000000000 R09: 0000000000000000 [ 471.871663][T12608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.871675][T12608] R13: 00007f5665616038 R14: 00007f5665615fa0 R15: 00007f566573fa48 [ 471.871706][T12608] [ 472.043842][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 472.177346][ T807] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 472.321977][ T807] usb 4-1: device descriptor read/64, error -71 [ 472.408252][T12614] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 472.433006][ T807] usb usb4-port1: attempt power cycle [ 472.791546][ T807] usb 4-1: new full-speed USB device number 86 using dummy_hcd [ 472.872308][ T807] usb 4-1: device descriptor read/8, error -71 [ 472.979224][T12624] binder: 12623:12624 ioctl c0306201 200000001440 returned -11 [ 473.133084][ T807] usb 4-1: new full-speed USB device number 87 using dummy_hcd [ 473.183981][ T807] usb 4-1: device descriptor read/8, error -71 [ 473.322835][ T807] usb usb4-port1: unable to enumerate USB device [ 473.633878][T12634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.686663][T12634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.749321][T12631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.792881][T12631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.844875][T12631] GUP no longer grows the stack in syz.2.1765 (12631): 200000007000-200000008000 (200000004000) [ 473.903735][T12631] CPU: 1 UID: 0 PID: 12631 Comm: syz.2.1765 Tainted: G L syzkaller #0 PREEMPT(full) [ 473.903769][T12631] Tainted: [L]=SOFTLOCKUP [ 473.903777][T12631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 473.903789][T12631] Call Trace: [ 473.903798][T12631] [ 473.903806][T12631] dump_stack_lvl+0xe8/0x150 [ 473.903844][T12631] fixup_user_fault+0x637/0x6f0 [ 473.903882][T12631] fault_in_user_writeable+0x71/0xd0 [ 473.903914][T12631] futex_lock_pi+0x814/0xb10 [ 473.903949][T12631] ? __pfx_futex_lock_pi+0x10/0x10 [ 473.903999][T12631] ? __pfx_futex_wake_mark+0x10/0x10 [ 473.904036][T12631] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 473.904066][T12631] do_futex+0x292/0x420 [ 473.904095][T12631] ? __pfx_do_futex+0x10/0x10 [ 473.904115][T12631] ? __vm_munmap+0x2e6/0x3d0 [ 473.904139][T12631] __se_sys_futex+0x3a8/0x450 [ 473.904165][T12631] ? __pfx___se_sys_futex+0x10/0x10 [ 473.904185][T12631] ? rcu_is_watching+0x15/0xb0 [ 473.904212][T12631] ? __x64_sys_futex+0x21/0xf0 [ 473.904233][T12631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.904254][T12631] do_syscall_64+0x15f/0xf80 [ 473.904277][T12631] ? trace_irq_disable+0x3b/0x140 [ 473.904303][T12631] ? clear_bhb_loop+0x40/0x90 [ 473.904328][T12631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.904348][T12631] RIP: 0033:0x7f54f039c819 [ 473.904367][T12631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.904384][T12631] RSP: 002b:00007f54ee5ee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 473.904406][T12631] RAX: ffffffffffffffda RBX: 00007f54f0615fa0 RCX: 00007f54f039c819 [ 473.904421][T12631] RDX: 0000000000000000 RSI: 000000000000008d RDI: 0000200000004000 [ 473.904434][T12631] RBP: 00007f54f0432c91 R08: 0000000000000000 R09: 0000000000000000 [ 473.904447][T12631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.904459][T12631] R13: 00007f54f0616038 R14: 00007f54f0615fa0 R15: 00007f54f073fa48 [ 473.904490][T12631] [ 474.131848][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 474.772824][ T5913] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 474.946684][T12651] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1768'. [ 475.003832][ T5913] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 475.021588][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.053302][ T5913] usb 6-1: Product: syz [ 475.075698][ T5913] usb 6-1: Manufacturer: syz [ 475.093767][ T5913] usb 6-1: SerialNumber: syz [ 475.374338][T12643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.440016][T12643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.515202][T12651] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1768'. [ 475.535619][ T5913] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 475.584708][ T5913] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 475.625797][ T5913] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 475.699061][ T5913] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 475.800514][ T5913] usb 6-1: USB disconnect, device number 75 [ 476.200049][T12664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.211902][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 476.276542][T12664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.057230][T12673] kvm: kvm [12672]: vcpu3, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010004) = 0x2 [ 477.364054][T12681] netlink: 164 bytes leftover after parsing attributes in process `syz.5.1779'. [ 477.408211][T12683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1780'. [ 477.442205][ T807] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 477.445588][T12683] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1780'. [ 477.633044][ T807] usb 5-1: Using ep0 maxpacket: 16 [ 477.700271][ T807] usb 5-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 477.747605][ T807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.786910][ T807] usb 5-1: Product: syz [ 477.796800][T12689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.830961][ T807] usb 5-1: Manufacturer: syz [ 477.837864][T12689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.856601][ T807] usb 5-1: SerialNumber: syz [ 477.885595][ T807] usb 5-1: config 0 descriptor?? [ 477.915255][ T807] safe_serial 5-1:0.0: safe_serial converter detected [ 477.954478][ T807] usb 5-1: safe_serial converter now attached to ttyUSB0 [ 478.218329][T12689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.218815][T12689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.291897][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 478.332169][T12694] program syz.3.1783 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 478.445754][ T5913] usb 5-1: USB disconnect, device number 73 [ 478.472796][ T5913] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 478.512105][ T5913] safe_serial 5-1:0.0: device disconnected [ 478.582481][ T807] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 478.748534][ T807] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 478.760210][ T807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.770736][ T807] usb 6-1: Product: syz [ 478.775871][ T807] usb 6-1: Manufacturer: syz [ 478.780743][ T807] usb 6-1: SerialNumber: syz [ 479.113364][T12696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.159392][T12696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.184578][ T24] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 479.354759][T12714] FAULT_INJECTION: forcing a failure. [ 479.354759][T12714] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 479.425430][T12714] CPU: 0 UID: 0 PID: 12714 Comm: syz.2.1787 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.425464][T12714] Tainted: [L]=SOFTLOCKUP [ 479.425472][T12714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 479.425501][T12714] Call Trace: [ 479.425510][T12714] [ 479.425521][T12714] dump_stack_lvl+0xe8/0x150 [ 479.425572][T12714] should_fail_ex+0x412/0x560 [ 479.425629][T12714] _copy_from_iter+0x1d3/0x1670 [ 479.425654][T12714] ? rcu_is_watching+0x15/0xb0 [ 479.425683][T12714] ? __pfx__copy_from_iter+0x10/0x10 [ 479.425712][T12714] ? netlink_sendmsg+0x650/0xb40 [ 479.425744][T12714] ? skb_put+0x11b/0x210 [ 479.425778][T12714] netlink_sendmsg+0x6c0/0xb40 [ 479.425820][T12714] ? __pfx_netlink_sendmsg+0x10/0x10 [ 479.425856][T12714] ? aa_sock_msg_perm+0xf1/0x1b0 [ 479.425879][T12714] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 479.425909][T12714] ____sys_sendmsg+0x972/0x9f0 [ 479.425931][T12714] ? __might_fault+0xaf/0x130 [ 479.425961][T12714] ? __pfx_____sys_sendmsg+0x10/0x10 [ 479.426000][T12714] ? import_iovec+0x73/0xa0 [ 479.426027][T12714] ___sys_sendmsg+0x2a5/0x360 [ 479.426048][T12714] ? __lock_acquire+0x6b5/0x2cf0 [ 479.426086][T12714] ? __pfx____sys_sendmsg+0x10/0x10 [ 479.426141][T12714] ? __fget_files+0x2a/0x420 [ 479.426163][T12714] ? __fget_files+0x3a0/0x420 [ 479.426196][T12714] __x64_sys_sendmsg+0x1bd/0x2a0 [ 479.426222][T12714] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 479.426254][T12714] ? __pfx_ksys_write+0x10/0x10 [ 479.426288][T12714] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.426312][T12714] do_syscall_64+0x15f/0xf80 [ 479.426339][T12714] ? trace_irq_disable+0x3b/0x140 [ 479.426367][T12714] ? clear_bhb_loop+0x40/0x90 [ 479.426394][T12714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.426415][T12714] RIP: 0033:0x7f54f039c819 [ 479.426435][T12714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 479.426459][T12714] RSP: 002b:00007f54ee5ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 479.426484][T12714] RAX: ffffffffffffffda RBX: 00007f54f0615fa0 RCX: 00007f54f039c819 [ 479.426500][T12714] RDX: 0000000020000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 479.426514][T12714] RBP: 00007f54ee5ee090 R08: 0000000000000000 R09: 0000000000000000 [ 479.426528][T12714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 479.426541][T12714] R13: 00007f54f0616038 R14: 00007f54f0615fa0 R15: 00007f54f073fa48 [ 479.426573][T12714] [ 479.489450][ T24] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 479.775241][ T24] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 479.787401][ T24] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 479.803924][ T24] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 479.814371][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.966828][ T807] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 480.016614][ T24] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 480.046635][ T807] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 480.067014][ T24] usb 4-1: invalid MIDI out EP 0 [ 480.115772][ T807] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 480.186097][T12720] binder: 12718:12720 ioctl c4089434 200000000840 returned -22 [ 480.192832][T12722] Invalid option length (65192) for dns_resolver key [ 480.246346][ T807] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 480.371992][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 480.397466][ T807] usb 6-1: USB disconnect, device number 76 [ 480.504128][T12726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1792'. [ 480.574108][T12726] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1792'. [ 480.777347][ T24] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 481.279372][T12735] program syz.5.1796 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 481.705638][T12738] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.712957][T12738] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.801159][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 481.839076][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 481.894036][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 481.932491][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 481.974133][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.018588][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.054814][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.119077][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.168340][T12738] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 482.179149][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.209688][ T5928] hid-generic 0000:0000:0004.0017: unknown main item tag 0x0 [ 482.258033][T12738] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.275656][ T5928] hid-generic 0000:0000:0004.0017: hidraw0: HID v0.03 Device [syz1] on syz0 [ 482.452075][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 482.620614][T12738] veth1_vlan: left allmulticast mode [ 482.690049][T12748] fido_id[12748]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 482.750866][T12741] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1795'. [ 483.160451][ T24] usb 4-1: USB disconnect, device number 88 [ 483.292923][ T1164] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.315909][ T1164] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.416466][T12755] FAULT_INJECTION: forcing a failure. [ 483.416466][T12755] name failslab, interval 1, probability 0, space 0, times 0 [ 483.445806][T12755] CPU: 1 UID: 0 PID: 12755 Comm: syz.5.1800 Tainted: G L syzkaller #0 PREEMPT(full) [ 483.445840][T12755] Tainted: [L]=SOFTLOCKUP [ 483.445849][T12755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 483.445863][T12755] Call Trace: [ 483.445873][T12755] [ 483.445890][T12755] dump_stack_lvl+0xe8/0x150 [ 483.445930][T12755] should_fail_ex+0x412/0x560 [ 483.445969][T12755] should_failslab+0xa8/0x100 [ 483.445998][T12755] ? skb_clone+0x212/0x3a0 [ 483.446025][T12755] kmem_cache_alloc_noprof+0x87/0x650 [ 483.446060][T12755] ? __netlink_lookup+0xc6/0x8b0 [ 483.446083][T12755] skb_clone+0x212/0x3a0 [ 483.446105][T12755] __netlink_deliver_tap+0x404/0x850 [ 483.446143][T12755] ? netlink_deliver_tap+0x2e/0x1b0 [ 483.446170][T12755] netlink_deliver_tap+0x19c/0x1b0 [ 483.446198][T12755] netlink_unicast+0x730/0x8e0 [ 483.446231][T12755] netlink_sendmsg+0x813/0xb40 [ 483.446267][T12755] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.446298][T12755] ? aa_sock_msg_perm+0xf1/0x1b0 [ 483.446317][T12755] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 483.446343][T12755] ____sys_sendmsg+0x972/0x9f0 [ 483.446362][T12755] ? __might_fault+0xaf/0x130 [ 483.446389][T12755] ? __pfx_____sys_sendmsg+0x10/0x10 [ 483.446417][T12755] ? import_iovec+0x73/0xa0 [ 483.446441][T12755] ___sys_sendmsg+0x2a5/0x360 [ 483.446458][T12755] ? __lock_acquire+0x6b5/0x2cf0 [ 483.446491][T12755] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.446541][T12755] ? __fget_files+0x2a/0x420 [ 483.446559][T12755] ? __fget_files+0x3a0/0x420 [ 483.446588][T12755] __x64_sys_sendmsg+0x1bd/0x2a0 [ 483.446610][T12755] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 483.446638][T12755] ? __pfx_ksys_write+0x10/0x10 [ 483.446670][T12755] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.446690][T12755] do_syscall_64+0x15f/0xf80 [ 483.446713][T12755] ? trace_irq_disable+0x3b/0x140 [ 483.446738][T12755] ? clear_bhb_loop+0x40/0x90 [ 483.446762][T12755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.446798][T12755] RIP: 0033:0x7f742199c819 [ 483.446816][T12755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.446834][T12755] RSP: 002b:00007f742287a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.446856][T12755] RAX: ffffffffffffffda RBX: 00007f7421c15fa0 RCX: 00007f742199c819 [ 483.446871][T12755] RDX: 0000000020000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 483.446892][T12755] RBP: 00007f742287a090 R08: 0000000000000000 R09: 0000000000000000 [ 483.446905][T12755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.446917][T12755] R13: 00007f7421c16038 R14: 00007f7421c15fa0 R15: 00007f7421d3fa48 [ 483.446949][T12755] [ 483.448455][ T1164] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.870605][ T1164] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.899931][ T1164] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.923086][ T1164] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.201774][ T5855] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 484.369243][ T5855] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 484.403540][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.435551][ T5855] usb 4-1: Product: syz [ 484.457741][ T5855] usb 4-1: Manufacturer: syz [ 484.483877][ T5855] usb 4-1: SerialNumber: syz [ 484.531899][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 484.580100][T12779] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1808'. [ 484.598399][T12779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 484.602415][ T134] bond0: (slave 55): interface is now down [ 484.703716][ T134] bond0: (slave bond_slave_1): interface is now down [ 484.739926][T12790] loop8: detected capacity change from 0 to 1 [ 484.750185][ T134] bond0: (slave dummy0): interface is now down [ 484.819779][T12762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.862168][T12790] Dev loop8: unable to read RDB block 1 [ 484.875797][T12762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.904409][ T134] bond0: now running without any active interface! [ 484.942722][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 484.966435][T12790] loop8: unable to read partition table [ 485.004199][T12790] loop8: partition table beyond EOD, truncated [ 485.010439][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 485.010467][ T5855] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 485.088009][T12790] loop_reread_partitions: partition scan of loop8 (被x^>અ;) failed (rc=-5) [ 485.128636][ T5855] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 485.194244][ T5855] usb 4-1: USB disconnect, device number 89 [ 485.378638][T12800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.404818][T12800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.963405][T12808] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1816'. [ 486.198328][T12813] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1818'. [ 486.231871][T12813] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1818'. [ 486.612007][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 486.753832][ T24] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 486.923773][ T24] usb 5-1: device descriptor read/64, error -71 [ 487.182552][ T24] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 487.332409][ T24] usb 5-1: device descriptor read/64, error -71 [ 487.485098][ T24] usb usb5-port1: attempt power cycle [ 487.556826][T12833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.617556][ T5928] hid_parser_main: 91 callbacks suppressed [ 487.617582][ T5928] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 487.634014][T12833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.760512][T12833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.776643][ T5928] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [syz1] on syz0 [ 487.810180][T12833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.862184][ T24] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 487.942837][ T24] usb 5-1: device descriptor read/8, error -71 [ 488.148446][ T29] kauditd_printk_skb: 52 callbacks suppressed [ 488.148466][ T29] audit: type=1326 audit(1776829221.600:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.228353][ T24] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 488.324748][ T29] audit: type=1326 audit(1776829221.640:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.385135][ T24] usb 5-1: device descriptor read/8, error -71 [ 488.439403][ T29] audit: type=1326 audit(1776829221.640:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.536299][ T24] usb usb5-port1: unable to enumerate USB device [ 488.566675][ T29] audit: type=1326 audit(1776829221.640:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.685884][ T29] audit: type=1326 audit(1776829221.640:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.693049][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 488.779699][ T29] audit: type=1326 audit(1776829221.640:808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.872095][ T29] audit: type=1326 audit(1776829221.640:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 488.990360][ T29] audit: type=1326 audit(1776829221.640:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=322 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 489.126035][ T29] audit: type=1326 audit(1776829221.650:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 489.241398][ T29] audit: type=1326 audit(1776829221.650:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12844 comm="syz.3.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f15a799c819 code=0x7ffc0000 [ 489.342177][ T24] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 489.822031][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 490.013100][ T24] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 490.031832][ T5855] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 490.043595][ T24] usb 4-1: config 0 has no interface number 0 [ 490.080147][ T24] usb 4-1: config 0 interface 196 altsetting 1 has an endpoint descriptor with address 0x9E, changing to 0x8E [ 490.136405][ T24] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x8E has invalid maxpacket 528 [ 490.194883][ T24] usb 4-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 490.233656][ T24] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 490.266041][ T5855] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 490.267267][ T24] usb 4-1: config 0 interface 196 has no altsetting 0 [ 490.331272][ T24] usb 4-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 490.347959][ T5855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.357869][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.370464][T12871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.387735][ T24] usb 4-1: Product: syz [ 490.395421][T12871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.416855][ T24] usb 4-1: Manufacturer: syz [ 490.434236][ T5855] usb 5-1: Product: syz [ 490.448484][ T24] usb 4-1: SerialNumber: syz [ 490.460721][ T5855] usb 5-1: Manufacturer: syz [ 490.491096][ T5855] usb 5-1: SerialNumber: syz [ 490.535880][ T24] usb 4-1: config 0 descriptor?? [ 490.550899][ T5855] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 490.600788][ T5913] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 490.771985][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 490.801336][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 490.944353][T12847] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 491.279299][T12861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.415581][T12861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.754209][ T5913] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 491.787210][ T5913] ath9k_htc: Failed to initialize the device [ 491.846388][ T5928] usb 5-1: USB disconnect, device number 78 [ 491.954996][ T5928] usb 5-1: ath9k_htc: USB layer deinitialized [ 492.852013][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 493.458045][ T24] usb 4-1: can't set config #0, error -71 [ 493.502227][ T24] usb 4-1: USB disconnect, device number 90 [ 493.986493][T12890] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1839'. [ 494.020296][T12889] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1839'. [ 494.049165][T12890] 8021q: VLANs not supported on wg2 [ 494.083195][T12889] 8021q: VLANs not supported on wg2 [ 494.118062][T12883] fuse: fd is not a fuse device [ 494.259635][ T29] kauditd_printk_skb: 41 callbacks suppressed [ 494.259656][ T29] audit: type=1326 audit(1776829227.710:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.365589][ T29] audit: type=1326 audit(1776829227.710:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.494323][ T29] audit: type=1326 audit(1776829227.750:856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.554559][ T29] audit: type=1326 audit(1776829227.750:857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.586486][ T29] audit: type=1326 audit(1776829227.760:858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.711501][ T29] audit: type=1326 audit(1776829227.760:859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.808932][ T29] audit: type=1326 audit(1776829227.760:860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 494.931982][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 494.941013][ T29] audit: type=1326 audit(1776829227.760:861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 495.000071][ T29] audit: type=1326 audit(1776829227.760:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 495.042116][ T29] audit: type=1326 audit(1776829227.760:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12897 comm="syz.1.1840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a9c59c819 code=0x7ffc0000 [ 495.632548][T12926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.713702][T12926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.802040][ T24] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 495.828931][T12926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.916628][T12926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.951537][ T24] usb 4-1: device descriptor read/64, error -71 [ 496.212266][ T24] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 496.352043][ T24] usb 4-1: device descriptor read/64, error -71 [ 496.473409][ T24] usb usb4-port1: attempt power cycle [ 496.843139][ T24] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 496.892772][ T24] usb 4-1: device descriptor read/8, error -71 [ 496.974954][T12942] FAULT_INJECTION: forcing a failure. [ 496.974954][T12942] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 497.012044][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 497.049830][T12942] CPU: 1 UID: 0 PID: 12942 Comm: syz.2.1852 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.049867][T12942] Tainted: [L]=SOFTLOCKUP [ 497.049876][T12942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 497.049890][T12942] Call Trace: [ 497.049898][T12942] [ 497.049908][T12942] dump_stack_lvl+0xe8/0x150 [ 497.049949][T12942] should_fail_ex+0x412/0x560 [ 497.049990][T12942] _copy_to_user+0x31/0xb0 [ 497.050018][T12942] simple_read_from_buffer+0xe1/0x170 [ 497.050047][T12942] proc_fail_nth_read+0x1bb/0x230 [ 497.050075][T12942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 497.050103][T12942] ? rw_verify_area+0x2a6/0x4d0 [ 497.050129][T12942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 497.050155][T12942] vfs_read+0x20c/0xa70 [ 497.050196][T12942] ? __pfx___mutex_lock+0x10/0x10 [ 497.050223][T12942] ? __pfx_vfs_read+0x10/0x10 [ 497.050248][T12942] ? __fget_files+0x2a/0x420 [ 497.050273][T12942] ? __fget_files+0x3a0/0x420 [ 497.050295][T12942] ? __fget_files+0x2a/0x420 [ 497.050324][T12942] ksys_read+0x150/0x270 [ 497.050351][T12942] ? __pfx_ksys_read+0x10/0x10 [ 497.050383][T12942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.050406][T12942] do_syscall_64+0x15f/0xf80 [ 497.050429][T12942] ? trace_irq_disable+0x3b/0x140 [ 497.050457][T12942] ? clear_bhb_loop+0x40/0x90 [ 497.050481][T12942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.050500][T12942] RIP: 0033:0x7f54f035d04e [ 497.050520][T12942] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 497.050538][T12942] RSP: 002b:00007f54ee5edfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 497.050559][T12942] RAX: ffffffffffffffda RBX: 00007f54ee5ee6c0 RCX: 00007f54f035d04e [ 497.050574][T12942] RDX: 000000000000000f RSI: 00007f54ee5ee0a0 RDI: 0000000000000006 [ 497.050587][T12942] RBP: 00007f54ee5ee090 R08: 0000000000000000 R09: 0000000000000000 [ 497.050600][T12942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 497.050611][T12942] R13: 00007f54f0616038 R14: 00007f54f0615fa0 R15: 00007f54f073fa48 [ 497.050643][T12942] [ 497.402372][ T24] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 497.422651][ T24] usb 4-1: device descriptor read/8, error -71 [ 497.539278][ T24] usb usb4-port1: unable to enumerate USB device [ 497.751300][T12949] random: crng reseeded on system resumption [ 498.310056][T12955] loop2: detected capacity change from 0 to 7 [ 498.334079][T12952] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 498.370135][T12955] Dev loop2: unable to read RDB block 7 [ 498.434077][T12955] loop2: unable to read partition table [ 498.465326][T12955] loop2: partition table beyond EOD, truncated [ 498.502269][T12955] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 499.092138][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 499.561745][ T5913] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 499.729124][T12983] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1863'. [ 499.788396][ T5913] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 499.826348][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.875749][ T5913] usb 5-1: Product: syz [ 499.899393][ T5913] usb 5-1: Manufacturer: syz [ 499.924739][ T5913] usb 5-1: SerialNumber: syz [ 499.952165][ T24] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 500.192222][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 500.237127][T12973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.262829][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 500.302521][T12973] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.319863][ T24] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 500.367896][ T24] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 500.403585][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 500.428679][ T24] usb 6-1: Manufacturer: syz [ 500.454853][ T24] usb 6-1: config 0 descriptor?? [ 500.514861][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 500.586866][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 500.671349][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 500.742415][ T5913] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 500.802105][ T5913] usb 5-1: USB disconnect, device number 79 [ 501.172306][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 501.284681][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.350323][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.380352][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.393351][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.515578][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.668851][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.697290][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.777425][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.799276][ T24] pyra 0003:1E7D:2CF6.0019: unknown main item tag 0x0 [ 501.860355][ T24] pyra 0003:1E7D:2CF6.0019: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.5-1/input0 [ 502.748383][ T24] pyra 0003:1E7D:2CF6.0019: couldn't init struct pyra_device [ 502.794011][ T24] pyra 0003:1E7D:2CF6.0019: couldn't install mouse [ 502.868925][ T24] pyra 0003:1E7D:2CF6.0019: probe with driver pyra failed with error -71 [ 502.965507][ T24] usb 6-1: USB disconnect, device number 77 [ 503.252136][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 503.319081][T13008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.402719][T13005] fido_id[13005]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 503.518714][T13008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.692695][T13010] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 503.712419][T13010] block device autoloading is deprecated and will be removed. [ 504.312092][ T24] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 504.497726][ T24] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 504.507945][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.518090][ T24] usb 5-1: Product: syz [ 504.523311][ T24] usb 5-1: Manufacturer: syz [ 504.528253][ T24] usb 5-1: SerialNumber: syz [ 504.567936][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1877'. [ 504.608846][T13032] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1877'. [ 504.816884][T13024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.877346][T13024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.939166][T13043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.973123][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 504.999754][T13043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.055805][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 505.115091][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 505.153325][T13046] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1880'. [ 505.169293][ T24] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 505.248752][ T24] usb 5-1: USB disconnect, device number 80 [ 505.300365][T13043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.331912][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 505.358476][T13020] syz.3.1873 (13020): drop_caches: 2 [ 505.367396][T13043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.519121][T13043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.543387][T13043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.555732][T13051] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 506.463320][ T5913] usb 4-1: new full-speed USB device number 95 using dummy_hcd [ 506.654347][ T5913] usb 4-1: unable to get BOS descriptor or descriptor too short [ 506.682763][ T29] kauditd_printk_skb: 129 callbacks suppressed [ 506.682785][ T29] audit: type=1326 audit(1776829240.140:993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 506.745027][ T5913] usb 4-1: not running at top speed; connect to a high speed hub [ 506.789676][ T5913] usb 4-1: config 1 has an invalid interface number: 171 but max is 0 [ 506.812221][ T29] audit: type=1326 audit(1776829240.180:994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 506.824986][ T5913] usb 4-1: config 1 has no interface number 0 [ 506.844347][ T29] audit: type=1326 audit(1776829240.180:995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 506.872160][ T29] audit: type=1326 audit(1776829240.180:996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 506.894704][ T5855] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 506.904109][ T29] audit: type=1326 audit(1776829240.180:997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 506.958529][ T5913] usb 4-1: config 1 interface 171 altsetting 15 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 506.986696][ T29] audit: type=1326 audit(1776829240.180:998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 507.059302][ T5913] usb 4-1: config 1 interface 171 has no altsetting 0 [ 507.066441][ T29] audit: type=1326 audit(1776829240.190:999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 507.096440][ T5913] usb 4-1: New USB device found, idVendor=0421, idProduct=0007, bcdDevice=d0.5e [ 507.111770][ T5855] usb 6-1: Using ep0 maxpacket: 32 [ 507.115650][ T29] audit: type=1326 audit(1776829240.390:1000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 507.153025][ T5855] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 507.170870][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.189067][ T5855] usb 6-1: config 0 has no interface number 0 [ 507.201104][ T29] audit: type=1326 audit(1776829240.390:1001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 507.231428][ T5913] usb 4-1: Product: syz [ 507.242268][ T5855] usb 6-1: config 0 interface 184 has no altsetting 0 [ 507.249211][ T5913] usb 4-1: Manufacturer: syz [ 507.269608][ T5913] usb 4-1: SerialNumber: syz [ 507.294523][ T5855] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 507.323043][ T29] audit: type=1326 audit(1776829240.390:1002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13067 comm="syz.2.1887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f54f039c819 code=0x7ffc0000 [ 507.346375][ T5855] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.387729][ T5855] usb 6-1: Product: syz [ 507.411895][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 507.432545][ T5855] usb 6-1: Manufacturer: syz [ 507.470132][ T5855] usb 6-1: SerialNumber: syz [ 507.559351][ T5855] usb 6-1: config 0 descriptor?? [ 508.307478][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000044: -71 [ 508.358647][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_DATA [ 508.445652][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 508.528189][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 508.587405][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 508.676565][ T5855] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 508.727443][ T5855] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 508.804003][T13084] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 508.827384][ T5855] usb 6-1: USB disconnect, device number 78 [ 509.280231][ T5913] rndis_host 4-1:1.171: skipping garbage [ 509.311860][ T5913] rndis_host 4-1:1.171: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 509.377064][ T5913] cdc_acm 4-1:1.171: skipping garbage [ 509.444963][ T5913] usb 4-1: USB disconnect, device number 95 [ 509.492026][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 510.092148][ T5913] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 510.285585][ T5913] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 510.333442][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.375287][ T5913] usb 5-1: Product: syz [ 510.399134][ T5913] usb 5-1: Manufacturer: syz [ 510.419005][ T5913] usb 5-1: SerialNumber: syz [ 510.583844][T13102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1895'. [ 510.633696][T13102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1895'. [ 510.706051][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 510.753591][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 510.803002][ T5913] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 510.850755][ T5913] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 510.905158][ T5913] usb 5-1: USB disconnect, device number 81 [ 511.360755][T13129] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1901'. [ 511.571918][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 511.589602][T13132] input: syz0 as /devices/virtual/input/input30 [ 512.364177][T13135] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 512.932137][ T24] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 513.092216][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 513.141023][ T24] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 513.175182][ T24] usb 5-1: config 0 has no interface number 0 [ 513.205766][ T24] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 513.258749][ T24] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 513.344128][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.417824][ T24] usb 5-1: Product: syz [ 513.462933][ T24] usb 5-1: Manufacturer: syz [ 513.476781][ T24] usb 5-1: SerialNumber: syz [ 513.515035][ T24] usb 5-1: config 0 descriptor?? [ 513.554749][ T24] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 513.574450][T13155] validate_nla: 23 callbacks suppressed [ 513.574480][T13155] netlink: 'syz.2.1909': attribute type 5 has an invalid length. [ 513.593130][ T24] em28xx 5-1:0.132: Video interface 132 found: [ 513.652052][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 514.010119][ T24] em28xx 5-1:0.132: unknown em28xx chip ID (0) [ 514.150621][ T24] em28xx 5-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 514.188688][ T24] em28xx 5-1:0.132: board has no eeprom [ 514.274031][ T24] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 514.314905][ T24] em28xx 5-1:0.132: analog set to bulk mode. [ 514.344403][ T5928] em28xx 5-1:0.132: Registering V4L2 extension [ 514.378480][ T24] usb 5-1: USB disconnect, device number 82 [ 514.441049][ T24] em28xx 5-1:0.132: Disconnecting em28xx [ 514.465239][T13160] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 515.279270][ T5928] em28xx 5-1:0.132: Config register raw data: 0xffffffed [ 515.309688][ T5928] em28xx 5-1:0.132: AC97 chip type couldn't be determined [ 515.346194][ T5928] em28xx 5-1:0.132: No AC97 audio processor [ 515.574771][ T5928] usb 5-1: Decoder not found [ 515.598452][ T5928] em28xx 5-1:0.132: failed to create media graph [ 515.640587][ T5928] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 515.732102][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 515.800487][ T5928] em28xx 5-1:0.132: Remote control support is not available for this card. [ 515.823575][ T24] em28xx 5-1:0.132: Closing input extension [ 515.919609][ T24] em28xx 5-1:0.132: Freeing device [ 516.242494][ T24] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 516.410074][T13182] bond9: entered promiscuous mode [ 516.436128][ T24] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 516.449442][T13182] bond9: entered allmulticast mode [ 516.477968][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.500983][T13182] 8021q: adding VLAN 0 to HW filter on device bond9 [ 516.525859][ T24] usb 5-1: Product: syz [ 516.554420][ T24] usb 5-1: Manufacturer: syz [ 516.584788][ T24] usb 5-1: SerialNumber: syz [ 516.744320][T13193] tipc: Enabling of bearer rejected, failed to enable media [ 516.905728][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 516.967011][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 517.019300][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 517.078574][ T24] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 517.132100][ T24] usb 5-1: USB disconnect, device number 83 [ 517.210002][T13202] loop2: detected capacity change from 0 to 7 [ 517.248080][T13202] Dev loop2: unable to read RDB block 7 [ 517.279879][T13202] loop2: unable to read partition table [ 517.319452][T13202] loop2: partition table beyond EOD, truncated [ 517.357632][T13202] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 517.402316][T13200] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1919'. [ 517.767180][T13206] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1923'. [ 517.795236][T13208] netlink: 'syz.4.1922': attribute type 1 has an invalid length. [ 517.811896][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 517.848969][T13208] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1922'. [ 517.902355][T13211] netlink: 207496 bytes leftover after parsing attributes in process `syz.4.1922'. [ 518.995357][T13230] bond11: entered promiscuous mode [ 519.041877][T13230] bond11: entered allmulticast mode [ 519.059376][T13230] 8021q: adding VLAN 0 to HW filter on device bond11 [ 519.356379][T13238] loop2: detected capacity change from 0 to 7 [ 519.386764][T13238] Dev loop2: unable to read RDB block 7 [ 519.407917][T13238] loop2: unable to read partition table [ 519.426651][T13238] loop2: partition table beyond EOD, truncated [ 519.456676][T13238] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 519.647578][T13243] x_tables: duplicate underflow at hook 3 [ 519.711993][ T24] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 519.814046][T13247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1935'. [ 519.891814][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 519.939154][ T24] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 519.965329][T13245] 8021q: VLANs not supported on ip_vti0 [ 519.976365][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.003301][ T24] usb 6-1: Product: syz [ 520.013882][ T24] usb 6-1: Manufacturer: syz [ 520.031011][ T24] usb 6-1: SerialNumber: syz [ 520.319182][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 520.348448][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 520.376317][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 520.398420][ T24] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 520.434304][ T24] usb 6-1: USB disconnect, device number 79 [ 521.406249][T13271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.425261][T13267] binder: 13266:13267 ioctl c0306201 0 returned -14 [ 521.449229][T13271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.479108][T13267] binder: 13266:13267 ioctl c0306201 200000001440 returned -11 [ 521.746518][T13280] loop2: detected capacity change from 0 to 7 [ 521.791769][T13280] Dev loop2: unable to read RDB block 7 [ 521.808023][T13276] bond10: entered promiscuous mode [ 521.835740][T13280] loop2: unable to read partition table [ 521.851524][T13276] bond10: entered allmulticast mode [ 521.857610][T13276] 8021q: adding VLAN 0 to HW filter on device bond10 [ 521.872273][T13280] loop2: partition table beyond EOD, truncated [ 521.933053][T13280] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 521.972034][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 522.278174][T13288] input: syz0 as /devices/virtual/input/input32 [ 522.622067][ T24] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 522.845376][ T24] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 522.867528][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.888259][ T24] usb 4-1: Product: syz [ 522.898391][ T24] usb 4-1: Manufacturer: syz [ 522.904301][ T24] usb 4-1: SerialNumber: syz [ 523.180373][ T24] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 523.218621][T13306] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1954'. [ 523.228720][ T24] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 523.244547][ T24] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 523.253694][T13308] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1954'. [ 523.293738][ T24] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 523.360546][ T24] usb 4-1: USB disconnect, device number 96 [ 523.512227][ T5913] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 523.691910][ T5913] usb 6-1: Using ep0 maxpacket: 8 [ 523.713698][ T5913] usb 6-1: unable to get BOS descriptor or descriptor too short [ 523.729505][T13316] bond10: entered promiscuous mode [ 523.735042][ T5913] usb 6-1: config 9 has an invalid interface number: 160 but max is 0 [ 523.735072][ T5913] usb 6-1: config 9 has no interface number 0 [ 523.735112][ T5913] usb 6-1: config 9 interface 160 altsetting 6 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 523.735138][ T5913] usb 6-1: config 9 interface 160 altsetting 6 endpoint 0x86 has an invalid bInterval 132, changing to 7 [ 523.735167][ T5913] usb 6-1: config 9 interface 160 altsetting 6 bulk endpoint 0xC has invalid maxpacket 32 [ 523.735192][ T5913] usb 6-1: config 9 interface 160 altsetting 6 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 523.735219][ T5913] usb 6-1: config 9 interface 160 has no altsetting 0 [ 523.806550][ T5913] usb 6-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=39.33 [ 523.832107][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.833124][T13316] bond10: entered allmulticast mode [ 523.860683][ T5913] usb 6-1: Product: syz [ 523.869260][T13316] 8021q: adding VLAN 0 to HW filter on device bond10 [ 523.871181][ T5913] usb 6-1: Manufacturer: syz [ 523.900969][ T5913] usb 6-1: SerialNumber: syz [ 523.932786][T13310] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 524.052457][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 524.215449][ T24] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 524.316398][ T5913] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 524.394793][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 524.410072][ T24] usb 4-1: config 0 has an invalid interface number: 237 but max is 2 [ 524.434046][ T24] usb 4-1: config 0 has an invalid interface number: 233 but max is 2 [ 524.479964][ T24] usb 4-1: config 0 has an invalid interface number: 54 but max is 2 [ 524.522601][ T24] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 524.565671][ T24] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 524.608871][ T24] usb 4-1: config 0 has no interface number 0 [ 524.628996][ T24] usb 4-1: config 0 has no interface number 1 [ 524.642259][ T24] usb 4-1: config 0 has no interface number 2 [ 524.658650][ T24] usb 4-1: config 0 interface 233 altsetting 8 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 524.724863][ T5913] usb 6-1: USB disconnect, device number 80 [ 524.787200][ T24] usb 4-1: config 0 interface 233 altsetting 8 bulk endpoint 0xC has invalid maxpacket 8 [ 524.842910][ T24] usb 4-1: config 0 interface 233 altsetting 8 endpoint 0x5 has an invalid bInterval 127, changing to 10 [ 524.875514][ T24] usb 4-1: config 0 interface 233 altsetting 8 has a duplicate endpoint with address 0x1, skipping [ 524.923074][ T5991] udevd[5991]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:9.160/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 524.950174][ T24] usb 4-1: config 0 interface 54 altsetting 7 bulk endpoint 0x3 has invalid maxpacket 1024 [ 524.989297][T13330] input: syz0 as /devices/virtual/input/input33 [ 525.050773][ T24] usb 4-1: config 0 interface 54 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 525.144761][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0xF, skipping [ 525.225429][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0xF, skipping [ 525.273119][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0x1, skipping [ 525.319510][ T24] usb 4-1: config 0 interface 54 altsetting 7 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 525.346837][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0xC, skipping [ 525.403853][ T24] usb 4-1: config 0 interface 54 altsetting 7 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 525.457813][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 525.485302][T13337] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.532632][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0xC, skipping [ 525.617098][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 525.633178][T13337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.677897][ T24] usb 4-1: config 0 interface 54 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 525.743522][ T24] usb 4-1: config 0 interface 54 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 525.791257][ T24] usb 4-1: config 0 interface 54 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 525.849890][ T24] usb 4-1: config 0 interface 237 has no altsetting 0 [ 525.887195][ T24] usb 4-1: config 0 interface 233 has no altsetting 0 [ 525.906077][ T24] usb 4-1: config 0 interface 54 has no altsetting 0 [ 525.915661][T13343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.930823][ T24] usb 4-1: Dual-Role OTG device on HNP port [ 525.939979][ T24] usb 4-1: New USB device found, idVendor=1164, idProduct=2edc, bcdDevice=94.d7 [ 525.950112][ T5928] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 525.969824][T13343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.986537][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.996638][ T24] usb 4-1: Product: syz [ 526.000916][ T24] usb 4-1: Manufacturer: syz [ 526.020894][ T24] usb 4-1: SerialNumber: syz [ 526.042860][ T24] usb 4-1: config 0 descriptor?? [ 526.133572][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 526.143054][ T5928] usb 6-1: Using ep0 maxpacket: 32 [ 526.150496][ T5928] usb 6-1: config 123 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 10 [ 526.168731][ T5928] usb 6-1: config 123 interface 0 has no altsetting 0 [ 526.183297][ T5928] usb 6-1: New USB device found, idVendor=2040, idProduct=c612, bcdDevice=e5.51 [ 526.194782][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.203928][ T5928] usb 6-1: Product: syz [ 526.208193][ T5928] usb 6-1: Manufacturer: syz [ 526.213828][ T5928] usb 6-1: SerialNumber: syz [ 526.283618][ T24] dvb-usb: found a 'Yuan PD378S' in cold state, will try to load a firmware [ 526.570958][T13351] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1967'. [ 526.687402][ T5928] usb 6-1: dvb_usb_v2: found a 'Hauppauge 126xxx' in warm state [ 526.733339][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 526.744208][ T5928] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 526.761030][ T24] dib0700: firmware download failed at 7 with -8 [ 526.771920][ T5928] dvbdev: DVB: registering new adapter (Hauppauge 126xxx) [ 526.810820][T13354] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN PTI [ 526.822867][T13354] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 526.831362][T13354] CPU: 0 UID: 0 PID: 13354 Comm: syz.1.1968 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.842341][T13354] Tainted: [L]=SOFTLOCKUP [ 526.846694][T13354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 526.856761][T13354] RIP: 0010:__mutex_lock+0x14e/0x1550 [ 526.862164][T13354] Code: e0 f3 4b 9a 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3e 12 00 00 83 3d b0 09 92 0e 00 75 23 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 d6 21 77 f6 4d 39 64 24 58 0f 85 6a 11 00 [ 526.881898][T13354] RSP: 0018:ffffc9000e207420 EFLAGS: 00010206 [ 526.888003][T13354] RAX: 0000000000000018 RBX: 0000000000000000 RCX: ffffffff9a4bf303 [ 526.895982][T13354] RDX: 0000000000000000 RSI: ffffffff8e24d447 RDI: 00000000000000c0 [ 526.904075][T13354] RBP: ffffc9000e2075d8 R08: ffffc9000e207547 R09: 0000000000000000 [ 526.912099][T13354] R10: ffffc9000e207520 R11: fffff52001c40ea9 R12: 0000000000000068 [ 526.920112][T13354] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92001c40e9c [ 526.928128][T13354] FS: 00007f5a9d4956c0(0000) GS:ffff888125217000(0000) knlGS:0000000000000000 [ 526.937095][T13354] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 526.943717][T13354] CR2: 00007f5a9d453d58 CR3: 00000000315a0000 CR4: 00000000003526f0 [ 526.951732][T13354] Call Trace: [ 526.955043][T13354] [ 526.957990][T13354] ? __mutex_lock+0x319/0x1550 [ 526.962785][T13354] ? __mutex_trylock_common+0x158/0x260 [ 526.968350][T13354] ? dvb_usbv2_generic_write+0x26/0x60 [ 526.973826][T13354] ? __pfx___mutex_lock+0x10/0x10 [ 526.978874][T13354] ? __pfx___mutex_lock+0x10/0x10 [ 526.983920][T13354] ? __mutex_lock+0x319/0x1550 [ 526.988699][T13354] dvb_usbv2_generic_write+0x26/0x60 [ 526.994006][T13354] mxl111sf_ctrl_msg+0x160/0x2f0 [ 526.998980][T13354] mxl111sf_write_reg+0xa9/0x1b0 [ 527.003964][T13354] ? __pfx_mxl111sf_write_reg+0x10/0x10 [ 527.009533][T13354] ? trace_event_raw_event_contention_begin+0x15a/0x1d0 [ 527.016495][T13354] mxl111sf_i2c_xfer+0x496/0x5100 [ 527.021543][T13354] ? unwind_next_frame+0xa6/0x2550 [ 527.026702][T13354] ? __pfx_mxl111sf_i2c_xfer+0x10/0x10 [ 527.032191][T13354] ? is_bpf_text_address+0x292/0x2b0 [ 527.037511][T13354] ? is_bpf_text_address+0x26/0x2b0 [ 527.042731][T13354] ? kernel_text_address+0xa5/0xe0 [ 527.047877][T13354] ? __kernel_text_address+0xd/0x30 [ 527.053092][T13354] ? unwind_get_return_address+0x4d/0x90 [ 527.058758][T13354] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 527.064931][T13354] ? arch_stack_walk+0xfb/0x150 [ 527.069805][T13354] ? stack_trace_save+0xa9/0x100 [ 527.074765][T13354] ? __pfx_stack_trace_save+0x10/0x10 [ 527.080160][T13354] ? stack_depot_save_flags+0x33/0x810 [ 527.085669][T13354] ? __pfx_stack_trace_save+0x10/0x10 [ 527.091064][T13354] ? look_up_lock_class+0x57/0x110 [ 527.096191][T13354] ? register_lock_class+0x31/0x2e0 [ 527.101409][T13354] ? __lock_acquire+0x6b5/0x2cf0 [ 527.106399][T13354] __i2c_transfer+0x79a/0x1f70 [ 527.111202][T13354] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 527.117031][T13354] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 527.122851][T13354] ? i2c_transfer+0xc8/0x2d0 [ 527.127464][T13354] i2c_transfer+0x1cc/0x2d0 [ 527.132001][T13354] i2cdev_ioctl_rdwr+0x460/0x740 [ 527.137149][T13354] i2cdev_ioctl+0x6a5/0x880 [ 527.141683][T13354] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 527.146739][T13354] ? __fget_files+0x3a0/0x420 [ 527.151431][T13354] ? __fget_files+0x2a/0x420 [ 527.156059][T13354] ? bpf_lsm_file_ioctl+0x9/0x20 [ 527.161047][T13354] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 527.166093][T13354] __se_sys_ioctl+0xfc/0x170 [ 527.170712][T13354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.176794][T13354] do_syscall_64+0x15f/0xf80 [ 527.181412][T13354] ? trace_irq_disable+0x3b/0x140 [ 527.186466][T13354] ? clear_bhb_loop+0x40/0x90 [ 527.191167][T13354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.197116][T13354] RIP: 0033:0x7f5a9c59c819 [ 527.201576][T13354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.221212][T13354] RSP: 002b:00007f5a9d495028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 527.229661][T13354] RAX: ffffffffffffffda RBX: 00007f5a9c816090 RCX: 00007f5a9c59c819 [ 527.237652][T13354] RDX: 0000200000000340 RSI: 0000000000000707 RDI: 0000000000000009 [ 527.245676][T13354] RBP: 00007f5a9c632c91 R08: 0000000000000000 R09: 0000000000000000 [ 527.253687][T13354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 527.261678][T13354] R13: 00007f5a9c816128 R14: 00007f5a9c816090 R15: 00007f5a9c93fa48 [ 527.269681][T13354] [ 527.272729][T13354] Modules linked in: [ 527.278604][T13354] ---[ end trace 0000000000000000 ]--- [ 527.283164][ T5928] usb 6-1: media controller created [ 527.295138][ T5928] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 527.312159][ T24] dvb-usb: found a 'Yuan PD378S' in cold state, will try to load a firmware [ 527.322750][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 527.330826][ T24] dib0700: firmware download failed at 7 with -8 [ 527.364453][T13358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.375403][T13354] RIP: 0010:__mutex_lock+0x14e/0x1550 [ 527.383254][ T24] dvb-usb: found a 'Yuan PD378S' in cold state, will try to load a firmware [ 527.395207][T13354] Code: e0 f3 4b 9a 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3e 12 00 00 83 3d b0 09 92 0e 00 75 23 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 d6 21 77 f6 4d 39 64 24 58 0f 85 6a 11 00 [ 527.418168][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 527.426720][ T24] dib0700: firmware download failed at 7 with -8 [ 527.438421][ T5928] set interface failed [ 527.442063][ T24] usb 4-1: USB disconnect, device number 97 [ 527.559087][T13358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.610631][T13354] RSP: 0018:ffffc9000e207420 EFLAGS: 00010206 [ 527.696481][T13354] RAX: 0000000000000018 RBX: 0000000000000000 RCX: ffffffff9a4bf303 [ 527.714898][T13354] RDX: 0000000000000000 RSI: ffffffff8e24d447 RDI: 00000000000000c0 [ 527.735357][T13354] RBP: ffffc9000e2075d8 R08: ffffc9000e207547 R09: 0000000000000000 [ 527.753046][T13354] R10: ffffc9000e207520 R11: fffff52001c40ea9 R12: 0000000000000068 [ 527.770316][T13354] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92001c40e9c [ 527.790622][T13354] FS: 00007f5a9d4956c0(0000) GS:ffff888125317000(0000) knlGS:0000000000000000 [ 527.809466][T13354] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 527.829580][T13354] CR2: 00002000003d9030 CR3: 00000000315a0000 CR4: 00000000003526f0 [ 527.855240][T13354] DR0: 00000000000088d5 DR1: 0000000000000000 DR2: 000000000000c732 [ 527.874946][T13354] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 527.906664][T13354] Kernel panic - not syncing: Fatal exception [ 527.913483][T13354] Kernel Offset: disabled [ 527.917822][T13354] Rebooting in 86400 seconds..