last executing test programs: 19m0.745839814s ago: executing program 3 (id=1100): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x2d, 0x0, 0x30, 0x19}, {0x41000, 0x3000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3}, {0xdddd1000, 0xe000, 0xb, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0xdddd0000, 0xffff1000, 0x3, 0x5d, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x7, 0xe, 0x4}, {0xdddd0000, 0x9000, 0x10, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x7e, 0xff, 0x70}, {0xd000, 0xb000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x16, 0x2, 0x3, 0x7, 0x9}, {0xb000, 0x2d}, {0x10000, 0x3ff}, 0x80000031, 0x0, 0x6000, 0x42024, 0xb, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0xff]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001b00)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) 18m57.730517746s ago: executing program 3 (id=1110): r0 = syz_open_dev$cec(&(0x7f0000000400), 0x0, 0x180) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000100)={"faffd411", 0x0, 0x6, 0x2, 0x9, 0x1, "f70000000000000000deffffff00", '\x00', "02000008", "0001ffff", ["50d5c3a7c5ae5cace40000b6", "828e88e2848663d0ffff00", "0cdd42000000000000c20d00", "0000000080000000f800"]}) 18m57.441366949s ago: executing program 3 (id=1113): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getpgid(0x0) 18m56.07259775s ago: executing program 3 (id=1115): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) socket(0x2d, 0x2, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) r0 = syz_open_dev$I2C(0x0, 0x1, 0x2603) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x2041, 0x0) ioctl$I2C_RDWR(r0, 0x707, 0x0) fsync(0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x4919, 0x0) 18m54.565783299s ago: executing program 3 (id=1120): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 18m50.303791051s ago: executing program 3 (id=1130): syz_open_procfs(0x0, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(0xffffffffffffffff, 0x0, 0x8000) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) 18m34.608231739s ago: executing program 32 (id=1130): syz_open_procfs(0x0, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(0xffffffffffffffff, 0x0, 0x8000) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) 17m25.089072971s ago: executing program 4 (id=1388): r0 = socket(0x400000000010, 0x3, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb7", 0x85}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29de8d9d", 0xd1}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e5372751cd23cc88571", 0x9c}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e", 0x73}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6e", 0x71}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x90}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081ff6ebac83c264c6deeec6d4546fe7d00337f488ecee46577d71b39e24cdef94f16295eb7", 0x47}], 0x1}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 17m24.665503797s ago: executing program 4 (id=1392): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha384\x00'}, 0x58) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) r3 = timerfd_create(0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000140)={&(0x7f000011b000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000021c0)=""/4105, 0x100a, 0x1, 0x0}, &(0x7f0000000340)=0x4b) timerfd_settime(r3, 0x3, &(0x7f0000000100)={{}, {0x0, 0x989680}}, 0x0) timerfd_gettime(r3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r5 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004f40)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}}, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={&(0x7f0000000500)=@l2tp6={0xa, 0x0, 0x3, @loopback, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) 17m13.099095855s ago: executing program 4 (id=1423): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={0x0, 0x68}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) io_setup(0x4, &(0x7f0000000080)=0x0) io_destroy(r4) r5 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000100)={r5}) bind$xdp(0xffffffffffffffff, &(0x7f00000005c0)={0x2d, 0x0, 0x0, 0xc}, 0x10) bind$xdp(r6, 0x0, 0x0) close(0x3) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={0x0}, 0x1, 0x0, 0x0, 0x44001}, 0x0) 17m8.476934808s ago: executing program 4 (id=1430): open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@deltaction={0x14, 0x31, 0x8, 0x70bd26, 0x25dfdbfb}, 0x14}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r3, @ANYBLOB="100001800400", @ANYRES8=r0], 0x28}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 17m7.152668705s ago: executing program 4 (id=1434): getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 17m1.770075896s ago: executing program 4 (id=1443): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0xb, 0x10000}}) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000002800)=ANY=[@ANYBLOB], 0xe0}}, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000400)={0x5, 0x2}) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, 0x0) flock(0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) openat$sequencer2(0xffffff9c, 0x0, 0x40, 0x0) 16m46.46237101s ago: executing program 33 (id=1443): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0xb, 0x10000}}) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000002800)=ANY=[@ANYBLOB], 0xe0}}, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000400)={0x5, 0x2}) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, 0x0) flock(0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) openat$sequencer2(0xffffff9c, 0x0, 0x40, 0x0) 15m24.276800906s ago: executing program 0 (id=1661): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 15m24.104929656s ago: executing program 0 (id=1662): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) r2 = userfaultfd(0x801) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f00000001c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 15m23.026835016s ago: executing program 0 (id=1665): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 15m20.345616039s ago: executing program 0 (id=1670): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) 15m16.476444428s ago: executing program 0 (id=1679): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 15m11.143483462s ago: executing program 0 (id=1695): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000240)=0x14) read(r0, 0x0, 0x0) 15m10.427222996s ago: executing program 34 (id=1695): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000240)=0x14) read(r0, 0x0, 0x0) 18.597291552s ago: executing program 1 (id=4597): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) io_setup(0x8, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) io_submit(0x0, 0x1, &(0x7f0000000340)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x8, 0x4, r1, &(0x7f0000000080)="01", 0x1, 0x3a25}]) 18.482240106s ago: executing program 1 (id=4599): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x1, r0}) ioctl$DMA_BUF_SET_NAME_A(r2, 0x40086203, 0x0) 18.293805165s ago: executing program 1 (id=4602): socket$kcm(0x29, 0x5, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc}) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffd, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x24, 0x0, 0x7ffffdbd}]}) r3 = shmget$private(0x0, 0x4000, 0x8, &(0x7f0000755000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000100)=ANY=[@ANYRES8=r1], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) 18.091064965s ago: executing program 1 (id=4603): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 17.977535998s ago: executing program 1 (id=4604): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x7101}) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x9, &(0x7f0000000000), 0x4) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f00000002c0)={&(0x7f0000000040)={0xa, 0x4e24, 0x1, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="2800000000000000290000000b000000000100000000000007080000000000000300000000000000a3cae70fc859356a8973b74f939d5b83afdabaa417eb3471ff479273acd7fe4dfe2d883d55951d4253edc044052c4241a253c36960b19eeacc1a39"], 0x28}, 0xff00) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c000780080012400000000505000500020000000500040001000000110003006861"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e220000"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r6, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) 17.785854038s ago: executing program 1 (id=4605): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x44, &(0x7f0000000040)={[{0x3d, 0x4e00, "5b08b0912442f849242d739e36a61e25f3ba477938b6ed9f247ed3d3ee88301809c39bd852c0ac6f7adaf09d2bebb69cadb19c4a709fefa26ad4caba71"}]}) syz_usb_connect$uac2(0x2, 0x0, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00030600000006"]}, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, 0x0) 16.235351983s ago: executing program 2 (id=4613): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000004100)={0x2020}, 0x2020) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@o_path={&(0x7f00000000c0)='./file0\x00', r2, 0x4000, r2}, 0x18) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sync() sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYRES32=0x0, @ANYBLOB="a7ffa88800000000200012800900010069706970000000fa0f000280040013000500090000000008f33a5798cb485f3a9776f093ab3e544599d87862ad961fa67f7215b55c42d37b9a100eb2ec063287898534c013c8f11d376156badd398f094e0e3b0cae09b813a27158392211de2312f2526854a5a004cb08dad59319ee0f21d26b"], 0x40}}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2b) r5 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0xb}, 0x94) syz_usb_control_io$uac2(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="40084f0000003a45444db441ba8f87f2de0e4872fc8bf45a40f05ee2dd90695e964d4c32c89580d16e26665c3cb71de602a74a933006000000000000009e550e6cce756bd0fcb4d76e82557a2a3105786e85061901"], 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000480)={0x20, 0x3, 0x1, 0x8}}) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f0000000140)={0x0, 0x7, 0x5, &(0x7f0000000100)={0x17, "537a1468df08000000758bd16868e0bf22c7b844c1b1f10186854fff98d2870c38"}}) 13.358052203s ago: executing program 5 (id=4615): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x4000, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) listen(r1, 0x7f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, &(0x7f0000000a80)=@tcp6=r1}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) flock(r3, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x10a) flock(r4, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8) flock(r5, 0x1) 12.480928759s ago: executing program 7 (id=4618): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @local}, @in6={0xa, 0x0, 0xfffffffc, @loopback, 0xc7f}], 0x2c) sendto$inet6(r1, &(0x7f0000000040)="e4", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, 0x0, 0x0) recvmmsg(r1, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x4}], 0x1, 0x40000023, 0x0) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07", @ANYRES32, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="010102007f"], 0x38}, 0x1, 0x0, 0x0, 0x400c884}, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2400c808) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x40020000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) close(0x3) fallocate(0xffffffffffffffff, 0x2c, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x2004d8b0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0x70bd26, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1f}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e21, 0x4e22}}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x44004) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x439, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0xa5}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40008c0) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000005180)={0x2020}, 0x2020) 11.247399305s ago: executing program 2 (id=4620): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x4000, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) listen(r1, 0x7f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, &(0x7f0000000a80)=@tcp6=r1}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) flock(r3, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x10a) flock(r4, 0x2) timer_create(0x0, 0x0, &(0x7f0000000300)) flock(0xffffffffffffffff, 0x1) 11.039292428s ago: executing program 5 (id=4621): dup(0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600100004"], 0x50) futex(&(0x7f0000000000)=0x2, 0xb, 0x2, 0x0, 0x0, 0x2) 11.001215823s ago: executing program 7 (id=4623): sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4008810}, 0x20000050) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4000840}, 0x4000084) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000002c0)="4a2b5af6b9c8af77a75979705a", 0xd) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000280), &(0x7f00000004c0)={0x0, 0xfb, 0x54, 0x1, 0xc, "ff4a635bc48ac1a11e421e42075c8a9a", "32dfd58f215cfebb8c3448e0a1de828b0be119310c991c8d88177ab470d0de4a33acbc40dffb1e91b399b084c6ee0bc4cc536cd5f98a0c75c3127ba02f7bd5"}, 0x54, 0x1) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45", 0xc8}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[]) 10.523071718s ago: executing program 5 (id=4625): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x10) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 9.726086106s ago: executing program 2 (id=4626): unshare(0x62040200) unshare(0x20000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x17e5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f00000000c0)=0x6a, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000009060102000000f8ffffff00000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c00028008000140"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 9.285907513s ago: executing program 5 (id=4627): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x4000, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) listen(r1, 0x7f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, &(0x7f0000000a80)=@tcp6=r1}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) flock(r3, 0x2) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x10a) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8) flock(r4, 0x1) 9.042613925s ago: executing program 7 (id=4628): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f00000033c0)=[{&(0x7f00000023c0)="681dab4746105dff56087d857f907e756f750c844a2dbceefbb1b9e9432d1f69795695ce799e64374f665bedd95285108b6f33b11956486abc94e0a47e3094d88f6fc0f7d5b9e138b02f25f3154e1a1bef03b3b4264a23c5dd46edf7c08d8e0a7b212210b56ac7f130ac0bb1e14c44a29df12c15ba705ff9df6b674f7fcbb5656d78aced8b61acbf6cbbb8008a1215c3080fdc70dda860dcf6966461071150d82f2510fda94a0470df400b708c52c8669e2c180f1a7601f3dcbf83bebfae0658b78705b2cdfbe8f7844ac420a238d6c7e9a70c7749ca4472c269d6d9cc789a86b7c1332c80cdd63a91ae2106b644a3faa4a52d861fbe2b9b4c29afe1881acb31bad71c0066274d37bb5e2bb77f3a2506fafa4874c05e7cf21d46f3c34c81a0b3aec1675ff763b57597e95d6c5519ad9658e6021251bc79aa4849aa8d227114d0e6f0612bddcaf794d47e92e53270ea9850fd851634e564d12387a5ae1d541014a14eb8e86d52dea77c7d00c69d06fbb0c3ec8dd751334e2c9fd58f93b21b9f768f7e5034f8e71c94cc943a1d605b8ea5d237d4229076cebd353935a6ab0ec667a2ffb8ee3297600650fafda4ac3c9f6c6e25285c7c04d250a0362724a985929352dae6ecf2a0eccae7078909314be7d337f7332a4b221a12d4e53253ac660df5670c33bc06128a2a65f3d5994a478e5d4cce880281024bc82126e2e81d8b4612626c08799ee8c64f9a76b58a7ec8b14a39b1027789edd624b02803703551e4a40c44972e3b4be7893a82982f3daebca8408dbfcc86c7a1b05fb7692aa147fba081898ba61e3dbf5ff7c7cc61088aa0d08bb2ab2a8c173cf87cfaec98146a8153b5fc44cc2792e5badaa00c253f9cca808aaed302162941da59366644f3bc70740658bb0675b66a9d93fac269e6382c2ae5c2306a8b4151d929ad39b94df5341e15922fa9db71af7fec5b2d4af5c52ab56b55b3df39555c3d4c3ef1be313a471b8e9036ddc744f603fdace70971ee2730857ef0a05d529acc354e5609d5e6b1544be3e5bf8cf8e286ce8ce6bd65c1291605447c116567ef80c0c954dcaa9a20be835ccc324d86722a082c966f3ae6f1e53f7b7b23efa0dba20f1d347538852169d23e63cf7271e45a6f7548a6a90c19cd4c18bbe1f97fbea9f3115c65a8d734746973b9409a5d02335f80bd206e44419f45ae0faa6449d90b89a6a8547bd3bb5aa7a8b31252da4ff757a8b16bd23a707c4dfd71042aa3840301cd6459a7e04f7941f20dcb66cc9fd8c3b7a3bc5da052c85b096b0dc3ef60b3e73d87e4dafa09131a46ee0d3483d52558bb926b2a388d841b9aa9638f3f43d306920a4b9f06dacc04233e203217fdd9bb4c048fc42dea0a071b688711167095d88c3f9a251064b7aed6b3e9887ae666616f6bb764638b838b1f0575365ab617c0033391cc2b29cb15be32afa8c66d3f7bbe6e011949068ee3acb948371fd6126130513ff4cd7a43c026686ec4dc6ac2aa992765c11f5858610569aff28d84b83fa2c8f50cb70181da80d5c2f483a9239cc8aaa6ad37358042f2763b42e52523594168dbabb557a40b4d28ae922b9973823f31261c2d1ef50ca91f3c0028ff00205b19e7bdb6df7cc1e52cac50112dbf8699fda1076388900601be9492077cfe8f2ce144035941d352e6af894a824e577ab39e906f7bca94c5c6717b25717c521f4453a7d5ab8b43815f66d0f574f91d7313b849e76a87647ad726544a73f2560f2290f74b34a2f163c322dd3d7cb4048f9af626d3513a4979df403e2ad9530f139a29b9ad9882a116bac9e1e7e5daa273ed4e2957f6e09421c99d6b050403ba7d6d7ca03c6065941f198a818c2d22d3bf4839c32e1cfdffc2b1c7c5c05ea99f1000a2fc4c7274a43c46c4f5a8d4145345255f2eb636cd06c557913a2ae3036aedf1a55440cdf5b9dd0e24c3c1b5102e50f0b0a3c19c9a96208771174e6ecea891b6b469ac3d97f134707892aee4836e756901c2f3d7842b957dc6252c0ebb20d0e2fea5783cd7f104c04259f1953adb7e4d4c4f8845f98682619014d3248dd8fd23081a642bd5713c79d9c3557569d4fad1b026e14628d841f26491737a77faebd86d5f2a36e3c95787a38d20e94cb50db2deee989efdfdfacfd0e5cc9d2f9b41177fd021dc64559068ed75c200ffaccba60653f13a1d9e3bbf1e58202bb8e1347d38ee3031c2e4b85fead08302ddbf0681fc41ce266b6cb087a09b97fdc2fb60ffe35fd492d3acd6759a4f40a7c50a0f7cb80660d8f5ffc342bcfb505eecd45678b72b59df01e2c4f806390098237f285cf2bf9e475bd96597575ce297c7715ea230a5713be05bbd89f535f4b9307841b81c76890496f8f79d206a1f339dc3103e5e0e79f4585eab6a3fbba8d63157e97b88abdcaebd1ae37afb853e17b8941de729f804e0e905d4aa10233f6c9810172f4a24488220e21a5bb6d9ec5575892f14b86eddc0c3e9be6d9fb4a3a03afd94e87975c2b2c6eaca151b35959de7dce2eff7e247d9724fe4aa591b671bf4aa4fe0a8ee4beb702a1c01e312e63e521ff01f4edbff7c7e9efea28f14cd19482cf5ecc71f58b7963cbcdfb334437559ede1977948767018cf30d265de174b0152955625b6b00fdb4d8c16b4c52993b7d8a53935659fe3790bba8d23a4e02a015fc2a5a20e213a7422ac62630b3e0452a0eca5fc2e1f03dc7bf3ef18e389056b87ba98655ec26f3ba30c844fb6939e594179e3b568e8fda8d23fbc92c83f3386e2e96f6c144447fb1eb53ca56a9eac401f488fd0c978d2679a28083ebd3a4e450984ce8bea949f760a8c46c25f910d1429c7cc98f662df74545293ee65bd6fc3ebf331d7ac4561ec58668492cbc25ec10be0938ef2b19aa4caaa0d6e0dcad07866292f3f7f27", 0x80d}], 0x1}}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000003400)}], 0x1}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 8.924665588s ago: executing program 7 (id=4629): sched_setaffinity(0x0, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000340)) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001280), r4) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="2503000000000000000008"], 0x14}}, 0x0) 8.836988464s ago: executing program 7 (id=4630): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0xc2400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200), 0x60242, 0x0) write$vga_arbiter(r3, &(0x7f00000010c0)=ANY=[@ANYBLOB="6c6f636b20696f11f90908ef332bcd00"], 0x8) close(r3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x6, 0x0, 0xfffffe0000000001, 0xfa11, 0xfffffff8}, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000040)={0x4000000, 0x400000}) close(r4) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8437f, 0x0) read$char_usb(0xffffffffffffffff, &(0x7f0000000040)=""/4109, 0x100d) openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0xd40, 0x82) lsm_get_self_attr(0x64, 0xffffffffffffffff, 0x0, 0x1) openat$btrfs_control(0xffffff9c, &(0x7f00000002c0), 0x20642, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1e000000040000", @ANYBLOB="010100"/13, @ANYRES32, @ANYRES32, @ANYBLOB="050000000300000003000000010000000000000000000000008a58da2201000000f2e106be3411e0b756fc67067f"], 0x50) 7.494235396s ago: executing program 6 (id=4632): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000000314"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80002, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000003c0)=0x2) syz_open_dev$mouse(&(0x7f0000000040), 0x0, 0x4000) 6.213504185s ago: executing program 2 (id=4633): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) io_setup(0x8, &(0x7f0000000540)=0x0) r2 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) io_submit(r1, 0x1, &(0x7f0000000340)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x8, 0x4, r2, &(0x7f0000000080)="01", 0x1, 0x3a25}]) 5.983997336s ago: executing program 5 (id=4634): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000004100)={0x2020}, 0x2020) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@o_path={&(0x7f00000000c0)='./file0\x00', r2, 0x4000, r2}, 0x18) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sync() sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYRES32=0x0, @ANYBLOB="a7ffa88800000000200012800900010069706970000000fa0f000280040013000500090000000008f33a5798cb485f3a9776f093ab3e544599d87862ad961fa67f7215b55c42d37b9a100eb2ec063287898534c013c8f11d376156badd398f094e0e3b0cae09b813a27158392211de2312f2526854a5a004cb08dad59319ee0f21d26b"], 0x40}}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2b) r5 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="800001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0xb}, 0x94) syz_usb_control_io$uac2(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="40084f0000003a45444db441ba8f87f2de0e4872fc8bf45a40f05ee2dd90695e964d4c32c89580d16e26665c3cb71de602a74a933006000000000000009e550e6cce756bd0fcb4d76e82557a2a3105786e85061901"], 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000480)={0x20, 0x3, 0x1, 0x8}}) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000140)={0x0, 0x7, 0x5, &(0x7f0000000100)={0x17, "537a1468df08000000758bd16868e0bf22c7b844c1b1f10186854fff98d2870c38"}}) 5.760587615s ago: executing program 2 (id=4635): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c0000001000010800000000000000", @ANYRES32=0x0], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) socket$key(0xf, 0x3, 0x2) ppoll(&(0x7f0000000100)=[{r3, 0x3a1}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'virt_wifi0\x00', 0x1}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x4, 0xe0, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) r4 = open(&(0x7f0000000280)='.\x00', 0x80, 0x28) fcntl$notify(r4, 0x402, 0x3b) mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x8042, 0x1f6) r6 = open(&(0x7f0000000180)='./file1\x00', 0x143142, 0x0) truncate(&(0x7f0000000000)='./file1\x00', 0x103000) splice(r6, 0x0, r5, 0x0, 0x59, 0x2) 4.729213973s ago: executing program 6 (id=4636): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r1, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000140)=0x4) r2 = dup2(r0, r0) read$FUSE(r2, 0x0, 0x0) 4.252064307s ago: executing program 6 (id=4637): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f00000033c0)=[{&(0x7f00000023c0)="681dab4746105dff56087d857f907e756f750c844a2dbceefbb1b9e9432d1f69795695ce799e64374f665bedd95285108b6f33b11956486abc94e0a47e3094d88f6fc0f7d5b9e138b02f25f3154e1a1bef03b3b4264a23c5dd46edf7c08d8e0a7b212210b56ac7f130ac0bb1e14c44a29df12c15ba705ff9df6b674f7fcbb5656d78aced8b61acbf6cbbb8008a1215c3080fdc70dda860dcf6966461071150d82f2510fda94a0470df400b708c52c8669e2c180f1a7601f3dcbf83bebfae0658b78705b2cdfbe8f7844ac420a238d6c7e9a70c7749ca4472c269d6d9cc789a86b7c1332c80cdd63a91ae2106b644a3faa4a52d861fbe2b9b4c29afe1881acb31bad71c0066274d37bb5e2bb77f3a2506fafa4874c05e7cf21d46f3c34c81a0b3aec1675ff763b57597e95d6c5519ad9658e6021251bc79aa4849aa8d227114d0e6f0612bddcaf794d47e92e53270ea9850fd851634e564d12387a5ae1d541014a14eb8e86d52dea77c7d00c69d06fbb0c3ec8dd751334e2c9fd58f93b21b9f768f7e5034f8e71c94cc943a1d605b8ea5d237d4229076cebd353935a6ab0ec667a2ffb8ee3297600650fafda4ac3c9f6c6e25285c7c04d250a0362724a985929352dae6ecf2a0eccae7078909314be7d337f7332a4b221a12d4e53253ac660df5670c33bc06128a2a65f3d5994a478e5d4cce880281024bc82126e2e81d8b4612626c08799ee8c64f9a76b58a7ec8b14a39b1027789edd624b02803703551e4a40c44972e3b4be7893a82982f3daebca8408dbfcc86c7a1b05fb7692aa147fba081898ba61e3dbf5ff7c7cc61088aa0d08bb2ab2a8c173cf87cfaec98146a8153b5fc44cc2792e5badaa00c253f9cca808aaed302162941da59366644f3bc70740658bb0675b66a9d93fac269e6382c2ae5c2306a8b4151d929ad39b94df5341e15922fa9db71af7fec5b2d4af5c52ab56b55b3df39555c3d4c3ef1be313a471b8e9036ddc744f603fdace70971ee2730857ef0a05d529acc354e5609d5e6b1544be3e5bf8cf8e286ce8ce6bd65c1291605447c116567ef80c0c954dcaa9a20be835ccc324d86722a082c966f3ae6f1e53f7b7b23efa0dba20f1d347538852169d23e63cf7271e45a6f7548a6a90c19cd4c18bbe1f97fbea9f3115c65a8d734746973b9409a5d02335f80bd206e44419f45ae0faa6449d90b89a6a8547bd3bb5aa7a8b31252da4ff757a8b16bd23a707c4dfd71042aa3840301cd6459a7e04f7941f20dcb66cc9fd8c3b7a3bc5da052c85b096b0dc3ef60b3e73d87e4dafa09131a46ee0d3483d52558bb926b2a388d841b9aa9638f3f43d306920a4b9f06dacc04233e203217fdd9bb4c048fc42dea0a071b688711167095d88c3f9a251064b7aed6b3e9887ae666616f6bb764638b838b1f0575365ab617c0033391cc2b29cb15be32afa8c66d3f7bbe6e011949068ee3acb948371fd6126130513ff4cd7a43c026686ec4dc6ac2aa992765c11f5858610569aff28d84b83fa2c8f50cb70181da80d5c2f483a9239cc8aaa6ad37358042f2763b42e52523594168dbabb557a40b4d28ae922b9973823f31261c2d1ef50ca91f3c0028ff00205b19e7bdb6df7cc1e52cac50112dbf8699fda1076388900601be9492077cfe8f2ce144035941d352e6af894a824e577ab39e906f7bca94c5c6717b25717c521f4453a7d5ab8b43815f66d0f574f91d7313b849e76a87647ad726544a73f2560f2290f74b34a2f163c322dd3d7cb4048f9af626d3513a4979df403e2ad9530f139a29b9ad9882a116bac9e1e7e5daa273ed4e2957f6e09421c99d6b050403ba7d6d7ca03c6065941f198a818c2d22d3bf4839c32e1cfdffc2b1c7c5c05ea99f1000a2fc4c7274a43c46c4f5a8d4145345255f2eb636cd06c557913a2ae3036aedf1a55440cdf5b9dd0e24c3c1b5102e50f0b0a3c19c9a96208771174e6ecea891b6b469ac3d97f134707892aee4836e756901c2f3d7842b957dc6252c0ebb20d0e2fea5783cd7f104c04259f1953adb7e4d4c4f8845f98682619014d3248dd8fd23081a642bd5713c79d9c3557569d4fad1b026e14628d841f26491737a77faebd86d5f2a36e3c95787a38d20e94cb50db2deee989efdfdfacfd0e5cc9d2f9b41177fd021dc64559068ed75c200ffaccba60653f13a1d9e3bbf1e58202bb8e1347d38ee3031c2e4b85fead08302ddbf0681fc41ce266b6cb087a09b97fdc2fb60ffe35fd492d3acd6759a4f40a7c50a0f7cb80660d8f5ffc342bcfb505eecd45678b72b59df01e2c4f806390098237f285cf2bf9e475bd96597575ce297c7715ea230a5713be05bbd89f535f4b9307841b81c76890496f8f79d206a1f339dc3103e5e0e79f4585eab6a3fbba8d63157e97b88abdcaebd1ae37afb853e17b8941de729f804e0e905d4aa10233f6c9810172f4a24488220e21a5bb6d9ec5575892f14b86eddc0c3e9be6d9fb4a3a03afd94e87975c2b2c6eaca151b35959de7dce2eff7e247d9724fe4aa591b671bf4aa4fe0a8ee4beb702a1c01e312e63e521ff01f4edbff7c7e9efea28f14cd19482cf5ecc71f58b7963cbcdfb334437559ede1977948767018cf30d265de174b0152955625b6b00fdb4d8c16b4c52993b7d8a53935659fe3790bba8d23a4e02a015fc2a5a20e213a7422ac62630b3e0452a0eca5fc2e1f03dc7bf3ef18e389056b87ba98655ec26f3ba30c844fb6939e594179e3b568e8fda8d23fbc92c83f3386e2e96f6c144447fb1eb53ca56a9eac401f488fd0c978d2679a28083ebd3a4e450984ce8bea949f760a8c46c25f910d1429c7cc98f662df74545293ee65bd6fc3ebf331d7ac4561ec58668492cbc25ec10be0938ef2b19aa4caaa0d6e0dcad07866292f3f7f27", 0x80d}], 0x1}}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000003400)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b", 0x29}], 0x1}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 3.889879304s ago: executing program 6 (id=4638): dup(0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600100004"], 0x50) futex(&(0x7f0000000000)=0x2, 0xb, 0x2, 0x0, 0x0, 0x2) 2.894928168s ago: executing program 6 (id=4639): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(0x0, 0x0) io_setup(0x8, &(0x7f0000000280)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0, 0x42}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000540)=[{{&(0x7f0000000300)={0xa, 0x4e1f, 0x0, @dev={0xfe, 0x80, '\x00', 0xd}, 0x4}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='o', 0x1}], 0x1}}], 0x1, 0x28018810) shutdown(r0, 0x1) 2.25214944s ago: executing program 7 (id=4640): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1, &(0x7f0000000080), 0x4) syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) getsockopt$sock_timeval(r0, 0x1, 0x43, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r1, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x7}) fcntl$lock(r1, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) fcntl$lock(r1, 0x7, &(0x7f00000000c0)={0x1, 0x2, 0x8, 0x73e9}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$vbi(0x0, 0x2, 0x2) socket$inet_sctp(0x2, 0x1, 0x84) 2.033694216s ago: executing program 6 (id=4641): socket$nl_netfilter(0x10, 0x3, 0xc) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}, 0x6}, 0x1c) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x20000000, 0xffffffffffffffff}, 0x10) modify_ldt$read(0x0, &(0x7f0000001840)=""/4105, 0x1009) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xd}, 0x1c) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0xc101) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000180)="b1", 0x58}], 0x1}, 0x10) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f0000000140)=0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x14, &(0x7f0000000440)=[{&(0x7f0000000280)="d8000000140081054e81f782db44b9040a1d08020a000000040000a118000200fe80000000000e1208000f0100a10401a80016eaa4000640feffffffffffffffb94dcf5c0461c1d67f6f94007134cf6ee08002a0e408e8d8ef075c817bd6c496ddffaa2795edb1e61e0100000000000000cb090000001fb791643a5ee4001b14547df36745d6d930dfe1d9d322fe7c9fd68775730d96a4683f5aeb4edbb57a5025ccca9e00158c89ed6cb4d1ac95e7765e04c2360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b4", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) r2 = socket(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, 0x0) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="200026bd7000fddbdf2506000000bfcade78ec541f830c217e02d6063339d3236e9d0da23124f94863f360b3b33463e107d88d39b49d3756049383998b5587c6e11601817f10366d689c935bcf6b0aae109312a0327ba2fd7dbcb2af7b7a353afe1a755ef631dfa6e410f322bc26309ea3f31e3fd19c2a13d2caaa97eb8f07d933f7c027926f904d96a7bda45bfa325e0a3786e648d5d0d8bb4d160e7d6bb0fb8635892fdf42735ba4818cabe29a2109788c8f4fb9c1481e14691dc33a5a06bc2e6d020ccba000d05b2ef2336c3dd355a1879d9a171073639340e8d2742e3e7dde5fd13509704d79f2294bcee0753e090b303f831794633091e36171f3882588459fe60bceeb2be531e3378289a44c8fc98dc83be59a1321fcf42c837431a714de7f15971373060be17c3b90c66033b43a78bfc60fa4b8d1e45dd2dd376cb71a6fa9d5a162a64350ef08e201de9c2886ddba7505f5085cb8a3eacad2aefa0da7c14da77602db52c9b7b17f33e8556f673423896a77962005d4ec6c9d38898c2760f04dc4fe43dade766f894b36b893ae7230a1dbf5754757f14abc3c87aa098c480dd27ca812048c52a92617219b79b10916a227f65bad76536a0f823855c9cb7e6267e9390b30f3befb1b384f13d19de1edeb7f30f3babd82706ac123c71d2180ae05dad9d2e5d72724d93c59b1fc03d3d4fcf29461ac5a70ee0b5928f2fd6b78a416ee2b2d7f0094eb611b395ac938beb027fcb18c6ca62ee650eddd1c77572a56103cd5b248e09817c65bacbc0672d02ff6ac9bd039ade4a222e6f01aee30cedda40d97219e9a179ca20746faf72ced452f38cadf50bb326259158b69da21eca0d9e1a871948ac196062b31a00ab09bd7b58f872dd433ed9e6133506e0cb1c31f14ce7709687005288d10530977f2cf430e7a48ad1c79c61aa1c341bf0642420e711745d5aefd6bb8f2e0438a63823172daf1ab7162"], 0x14}, 0x1, 0x0, 0x0, 0x24000080}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000200), 0x1, 0x208640) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000005c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xbc, r3, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x44}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x473a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1d6}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xc}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_hsr\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7ff}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4804}, 0x880) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d40)=@newqdisc={0x3a8, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x378, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x10, 0x2, 0xff}}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x64, 0x2, 0x3, 0x17, 0xd, 0x8, 0x1}}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "a2a88faa7ec665a571a9ad3d1f9512e3c591df4a4554c6c2e2cc6cb4d9aee4579684743ad4888f1522a47ddaff3d4f9450d288e8559bc4f795aa0d1bc74d926038adb808cba6e90535b2eb8ba3e8ff927207d17a86b10d604e77a459df67e7f0c842d463ca5977b7e2eb55fbb9881d15633717817c735da52a1da7d64bb22e58550d8ee20883e41ec2f119a6a6364d68900c1cce4a3b3225a9ce9e1e00b444e9e7bcd10e1dec202ce7786aa7cf10d4dd6bbcee586d7903a6239ff90b49cd7fddb0c67ddab326cdb2d0fa48a783f691be9ebaa1243b21afd04a372650aa7eb46a2675cc67ae12d3b99c9acb4d9fb7c78081d269b443affd86eededd4867311221"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x10}}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}]}, 0x3a8}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 652.16249ms ago: executing program 2 (id=4642): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x44, &(0x7f0000000040)={[{0x3d, 0x4e00, "5b08b0912442f849242d739e36a61e25f3ba477938b6ed9f247ed3d3ee88301809c39bd852c0ac6f7adaf09d2bebb69cadb19c4a709fefa26ad4caba71"}]}) syz_usb_connect$uac2(0x2, 0x0, 0x0, 0x0) 0s ago: executing program 5 (id=4643): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x1, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0x10000, 0x0, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x3e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x2b8, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x9, 0x5, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x4000) r5 = socket$kcm(0x29, 0x5, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) write$cgroup_pressure(r5, &(0x7f0000000140)={'full'}, 0xfffffdef) kernel console output (not intermixed with test programs): 502][T15235] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 1417.559901][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.572204][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.590652][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.610474][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.670327][T15235] usb 8-1: device descriptor read/64, error -71 [ 1417.717034][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.730630][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.750522][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.770452][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.790354][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.810343][ T5882] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1417.833650][ T5882] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1417.833675][ T5882] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1417.877505][ T5882] usb 3-1: USB disconnect, device number 53 [ 1417.920308][T15235] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 1418.050455][T15235] usb 8-1: device descriptor read/64, error -71 [ 1418.160638][T15235] usb usb8-port1: attempt power cycle [ 1418.502953][T15235] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 1418.522800][T15235] usb 8-1: device descriptor read/8, error -71 [ 1418.760313][T15235] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 1418.781100][T15235] usb 8-1: device descriptor read/8, error -71 [ 1418.890925][T15235] usb usb8-port1: unable to enumerate USB device [ 1419.788528][ T5882] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 1419.970428][ T5882] usb 2-1: Using ep0 maxpacket: 16 [ 1419.976257][ T5882] usb 2-1: config 0 has no interfaces? [ 1419.977551][ T5882] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1419.977579][ T5882] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1419.977611][ T5882] usb 2-1: Manufacturer: syz [ 1420.740464][ T5882] usb 2-1: config 0 descriptor?? [ 1421.161547][ T3580] hsr_slave_0: left promiscuous mode [ 1421.200395][ T3580] hsr_slave_1: left promiscuous mode [ 1421.201113][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1421.201134][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1421.244958][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1421.244985][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1421.335064][ T3580] veth1_macvtap: left promiscuous mode [ 1421.335130][ T3580] veth0_macvtap: left promiscuous mode [ 1421.335264][ T3580] veth1_vlan: left promiscuous mode [ 1421.335652][ T3580] veth0_vlan: left promiscuous mode [ 1422.481967][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 1422.540880][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 1423.088695][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.088765][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1425.126337][ T10] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1425.129487][T18877] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3830'. [ 1425.295880][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1425.295909][ T10] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1425.295947][ T10] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1425.295969][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1425.436446][ T10] usb 7-1: config 0 descriptor?? [ 1425.877166][T18578] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1425.939528][T18578] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1425.941524][T18578] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1426.052651][T18578] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1426.054597][ T9] usb 2-1: USB disconnect, device number 66 [ 1426.056403][T18578] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1426.177362][T18578] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1426.181136][T18578] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1426.375820][T18578] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1426.661805][ T3580] IPVS: stop unused estimator thread 0... [ 1427.952277][T14100] usb 7-1: USB disconnect, device number 21 [ 1428.931593][T18937] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1428.981548][T18578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1429.053319][T18578] 8021q: adding VLAN 0 to HW filter on device team0 [ 1429.067283][ T1024] bridge0: port 1(bridge_slave_0) entered blocking state [ 1429.078307][ T1024] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1429.094445][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 1429.095228][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1429.737304][T18578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1430.702027][T18578] veth0_vlan: entered promiscuous mode [ 1430.846112][T18578] veth1_vlan: entered promiscuous mode [ 1431.405070][T18578] veth0_macvtap: entered promiscuous mode [ 1431.439027][T18578] veth1_macvtap: entered promiscuous mode [ 1431.453155][T18974] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1431.572848][T18578] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1431.728831][T18578] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1431.769720][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1431.769969][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1432.564988][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1432.659510][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.553770][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1434.553791][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1434.683617][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1434.683638][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1434.937939][T18995] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1436.301386][T19020] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1439.024997][T19032] binder_alloc: 19031: binder_alloc_buf, no vma [ 1439.595850][T19042] netlink: 728 bytes leftover after parsing attributes in process `syz.2.3868'. [ 1439.968867][T19052] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3877'. [ 1442.520352][ T5882] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 1442.680354][ T5882] usb 8-1: Using ep0 maxpacket: 16 [ 1442.683585][ T5882] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1442.683638][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1442.683665][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1442.683686][ T5882] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1442.683710][ T5882] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1442.684937][ T5882] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1442.684964][ T5882] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1442.684981][ T5882] usb 8-1: Manufacturer: syz [ 1442.707999][ T5882] usb 8-1: config 0 descriptor?? [ 1443.000938][T19071] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3885'. [ 1443.180411][ T5882] rc_core: IR keymap rc-hauppauge not found [ 1443.180433][ T5882] Registered IR keymap rc-empty [ 1443.180525][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.201471][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.240589][ T5882] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1443.246358][ T5882] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input74 [ 1443.257077][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.270694][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.290486][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.324231][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.340362][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.360511][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.390461][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.410446][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.430466][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.450409][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1443.491006][ T5882] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1443.491023][ T5882] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1443.595194][ T5882] usb 8-1: USB disconnect, device number 38 [ 1443.992436][T19082] netlink: 728 bytes leftover after parsing attributes in process `syz.2.3888'. [ 1446.260278][T14807] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 1446.290384][T19096] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3894'. [ 1446.410339][T14807] usb 8-1: Using ep0 maxpacket: 16 [ 1446.416124][T14807] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1446.416179][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1446.416207][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1446.416228][T14807] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1446.416251][T14807] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1446.418228][T14807] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1446.418256][T14807] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1446.418276][T14807] usb 8-1: Manufacturer: syz [ 1446.528857][T14807] usb 8-1: config 0 descriptor?? [ 1446.745277][T19098] tipc: Enabling of bearer rejected, failed to enable media [ 1446.745522][T19100] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3896'. [ 1446.945987][T19106] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3898'. [ 1447.023463][T14807] rc_core: IR keymap rc-hauppauge not found [ 1447.023495][T14807] Registered IR keymap rc-empty [ 1447.024070][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.126669][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.487852][T14807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1447.554317][T14807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input76 [ 1447.574847][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.590463][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.611663][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.630410][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.650461][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.671014][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.690378][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.710344][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.730379][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.750474][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1447.780084][T14807] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1447.780111][T14807] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1447.820500][T14100] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1447.829631][T14807] usb 8-1: USB disconnect, device number 39 [ 1447.837214][ T37] kauditd_printk_skb: 13 callbacks suppressed [ 1447.837231][ T37] audit: type=1326 audit(1776515870.155:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.841279][ T37] audit: type=1326 audit(1776515870.155:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.847054][ T37] audit: type=1326 audit(1776515870.165:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.847373][ T37] audit: type=1326 audit(1776515870.165:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.848053][T19114] netlink: 732 bytes leftover after parsing attributes in process `syz.1.3901'. [ 1447.849050][ T37] audit: type=1326 audit(1776515870.165:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.850623][ T37] audit: type=1326 audit(1776515870.165:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.852685][ T37] audit: type=1326 audit(1776515870.175:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.859200][ T37] audit: type=1326 audit(1776515870.175:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.859637][ T37] audit: type=1326 audit(1776515870.175:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.859679][ T37] audit: type=1326 audit(1776515870.175:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19112 comm="syz.6.3900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e59a6c819 code=0x7ffc0000 [ 1447.991552][T14100] usb 6-1: Using ep0 maxpacket: 16 [ 1447.997135][T14100] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1447.997195][T14100] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1447.997223][T14100] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1447.997244][T14100] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1447.997265][T14100] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1447.998555][T14100] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1447.998581][T14100] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1447.998600][T14100] usb 6-1: Manufacturer: syz [ 1450.180943][T14100] usb 6-1: config 0 descriptor?? [ 1450.234872][T14100] usb 6-1: can't set config #0, error -71 [ 1450.237658][T14100] usb 6-1: USB disconnect, device number 27 [ 1450.340620][ T5889] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1450.523850][T19140] usb usb8: usbfs: process 19140 (syz.5.3907) did not claim interface 0 before use [ 1450.563696][ T5889] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1450.563726][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1450.571809][T19138] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1450.580987][ T5889] usb 2-1: config 0 descriptor?? [ 1450.915422][T19125] syz.1.3903: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1450.915645][T19125] CPU: 0 UID: 0 PID: 19125 Comm: syz.1.3903 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1450.915676][T19125] Tainted: [L]=SOFTLOCKUP [ 1450.915683][T19125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1450.915696][T19125] Call Trace: [ 1450.915704][T19125] [ 1450.915714][T19125] dump_stack_lvl+0xe8/0x150 [ 1450.915757][T19125] warn_alloc+0x263/0x3e0 [ 1450.915779][T19125] ? kasan_save_track+0x4f/0x80 [ 1450.915807][T19125] ? kasan_save_track+0x3e/0x80 [ 1450.915833][T19125] ? kasan_save_free_info+0x46/0x50 [ 1450.915857][T19125] ? __kasan_slab_free+0x5c/0x80 [ 1450.915885][T19125] ? tomoyo_path_number_perm+0x501/0x630 [ 1450.915917][T19125] ? security_file_ioctl+0xc3/0x2a0 [ 1450.915947][T19125] ? __se_sys_ioctl+0x47/0x170 [ 1450.915982][T19125] ? __pfx_warn_alloc+0x10/0x10 [ 1450.916022][T19125] __vmalloc_node_range_noprof+0x132/0x1750 [ 1450.916051][T19125] ? register_lock_class+0x31/0x2e0 [ 1450.916102][T19125] ? __lock_acquire+0x6b5/0x2cf0 [ 1450.916132][T19125] ? kasan_quarantine_put+0xbb/0x1f0 [ 1450.916170][T19125] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1450.916214][T19125] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1450.916238][T19125] vmalloc_noprof+0xb2/0xe0 [ 1450.916269][T19125] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1450.916292][T19125] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1450.916312][T19125] ? dvb_demux_do_ioctl+0x323/0x540 [ 1450.916348][T19125] dvb_demux_do_ioctl+0x460/0x540 [ 1450.916384][T19125] dvb_usercopy+0x199/0x2e0 [ 1450.916414][T19125] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1450.916445][T19125] ? __pfx_dvb_usercopy+0x10/0x10 [ 1450.916485][T19125] ? __fget_files+0x3a6/0x420 [ 1450.916511][T19125] ? __fget_files+0x2a/0x420 [ 1450.916539][T19125] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1450.916571][T19125] dvb_demux_ioctl+0x29/0x40 [ 1450.916604][T19125] __se_sys_ioctl+0xff/0x170 [ 1450.916636][T19125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1450.916660][T19125] do_syscall_64+0x15f/0xf80 [ 1450.916690][T19125] ? clear_bhb_loop+0x40/0x90 [ 1450.916717][T19125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1450.916738][T19125] RIP: 0033:0x7fe6b4b7c819 [ 1450.916758][T19125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1450.916777][T19125] RSP: 002b:00007fe6b2dce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1450.916798][T19125] RAX: ffffffffffffffda RBX: 00007fe6b4df5fa0 RCX: 00007fe6b4b7c819 [ 1450.916814][T19125] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000006 [ 1450.916828][T19125] RBP: 00007fe6b4c12c91 R08: 0000000000000000 R09: 0000000000000000 [ 1450.916840][T19125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1450.916852][T19125] R13: 00007fe6b4df6038 R14: 00007fe6b4df5fa0 R15: 00007ffff4aca0e8 [ 1450.916883][T19125] [ 1450.917190][T19125] Mem-Info: [ 1450.917333][T19125] active_anon:268 inactive_anon:7325 isolated_anon:0 [ 1450.917333][T19125] active_file:25956 inactive_file:35563 isolated_file:0 [ 1450.917333][T19125] unevictable:768 dirty:170 writeback:0 [ 1450.917333][T19125] slab_reclaimable:12667 slab_unreclaimable:107571 [ 1450.917333][T19125] mapped:32187 shmem:1371 pagetables:1618 [ 1450.917333][T19125] sec_pagetables:0 bounce:0 [ 1450.917333][T19125] kernel_misc_reclaimable:0 [ 1450.917333][T19125] free:1289184 free_pcp:13288 free_cma:0 [ 1450.917496][T19125] Node 0 active_anon:1072kB inactive_anon:29300kB active_file:103620kB inactive_file:142252kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128748kB dirty:680kB writeback:0kB shmem:3948kB kernel_stack:14204kB pagetables:6296kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1450.917591][T19125] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1450.917857][T19125] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1450.917928][T19125] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1450.918727][T19125] Node 0 DMA32 free:1202452kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1072kB inactive_anon:29300kB active_file:103620kB inactive_file:142252kB unevictable:1536kB writepending:680kB zspages:0kB present:3129332kB managed:2565008kB mlocked:0kB bounce:0kB free_pcp:53148kB local_pcp:47464kB free_cma:0kB [ 1450.919002][T19125] lowmem_reserve[]: 0 0 0 0 0 [ 1450.919088][T19125] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1450.919150][T19125] lowmem_reserve[]: 0 0 0 0 0 [ 1450.919170][T19125] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1450.919225][T19125] lowmem_reserve[]: 0 0 0 0 0 [ 1450.919259][T19125] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1450.919876][T19125] Node 0 DMA32: 2491*4kB (U) 2841*8kB (UM) 2502*16kB (UME) 763*32kB (UME) 477*64kB (UME) 570*128kB (UME) 435*256kB (UM) 269*512kB (UM) 129*1024kB (UME) 63*2048kB (UM) 120*4096kB (UM) = 1202356kB [ 1450.933383][T19125] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1450.933658][T19125] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1450.933819][T19125] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1450.933836][T19125] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1450.933852][T19125] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1450.933868][T19125] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1450.933886][T19125] 62886 total pagecache pages [ 1450.933894][T19125] 0 pages in swap cache [ 1450.933900][T19125] Free swap = 124996kB [ 1450.933908][T19125] Total swap = 124996kB [ 1450.933916][T19125] 2097051 pages RAM [ 1450.933924][T19125] 0 pages HighMem/MovableOnly [ 1450.933931][T19125] 424150 pages reserved [ 1450.933938][T19125] 0 pages cma reserved [ 1451.327833][ T5889] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1451.348090][ T5889] [drm:udl_init] *ERROR* Selecting channel failed [ 1451.659318][ T5889] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 1451.659336][ T5889] [drm] Initialized udl on minor 2 [ 1451.675429][ T5889] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1451.675710][ T5889] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 1451.712563][ T5889] usb 2-1: USB disconnect, device number 67 [ 1451.713393][ T5882] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1451.713748][ T5882] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 1452.289120][T19153] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3911'. [ 1453.070128][T19157] netlink: 732 bytes leftover after parsing attributes in process `syz.6.3912'. [ 1454.441744][T19166] binder_alloc: 19165: binder_alloc_buf, no vma [ 1454.949533][T14296] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 1455.138713][T14296] usb 8-1: Using ep0 maxpacket: 16 [ 1455.597713][T14296] usb 8-1: config 0 has no interfaces? [ 1455.601082][T14296] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1455.601111][T14296] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1455.601130][T14296] usb 8-1: Manufacturer: syz [ 1455.646435][T14296] usb 8-1: config 0 descriptor?? [ 1457.433874][T14807] usb 8-1: USB disconnect, device number 40 [ 1457.473206][T19191] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3924'. [ 1459.636830][T19208] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3928'. [ 1459.691892][T19210] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3928'. [ 1459.950364][ T10] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1460.760518][T14807] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1460.940278][T14807] usb 6-1: Using ep0 maxpacket: 8 [ 1460.942918][T14807] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.942970][T14807] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1461.477262][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 1461.478422][T14807] usb 6-1: New USB device found, idVendor=0bfd, idProduct=0124, bcdDevice=3a.9f [ 1461.478545][T14807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.478565][T14807] usb 6-1: Product: syz [ 1461.478579][T14807] usb 6-1: Manufacturer: syz [ 1461.478594][T14807] usb 6-1: SerialNumber: syz [ 1461.480572][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1461.480623][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1461.480651][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1461.480672][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1461.480696][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1461.482150][ T10] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1461.482175][ T10] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1461.482196][ T10] usb 7-1: Manufacturer: syz [ 1461.625194][ T10] usb 7-1: config 0 descriptor?? [ 1461.676371][T14807] usb 6-1: config 0 descriptor?? [ 1461.700107][T14807] kvaser_usb 6-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 1461.892891][T14807] usb 6-1: USB disconnect, device number 28 [ 1463.000465][ T10] rc_core: IR keymap rc-hauppauge not found [ 1463.000485][ T10] Registered IR keymap rc-empty [ 1463.000625][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.020415][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.117753][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 1463.126129][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input80 [ 1463.227470][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.241836][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.260374][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.280330][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.308041][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.320422][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.340440][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.349903][T19235] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3935'. [ 1463.360348][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.380409][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.400513][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1463.422158][ T10] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1463.422174][ T10] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1463.426053][ T10] usb 7-1: USB disconnect, device number 22 [ 1463.702722][T19240] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3939'. [ 1464.327272][T19248] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3941'. [ 1467.760134][T19273] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 1467.838046][T19273] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1467.848421][T19273] vhci_hcd vhci_hcd.0: Device attached [ 1467.883354][T19280] vhci_hcd: connection closed [ 1467.883696][ T1038] vhci_hcd vhci_hcd.2: stop threads [ 1467.883722][ T1038] vhci_hcd vhci_hcd.2: release socket [ 1467.883759][ T1038] vhci_hcd vhci_hcd.2: disconnect device [ 1468.010700][ T5820] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 1468.180321][ T5820] usb 7-1: Using ep0 maxpacket: 16 [ 1468.183068][ T5820] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1468.183120][ T5820] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1468.183155][ T5820] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1468.183176][ T5820] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1468.183198][ T5820] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1468.187462][ T5820] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1468.187492][ T5820] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1468.187512][ T5820] usb 7-1: Manufacturer: syz [ 1468.348386][ T5820] usb 7-1: config 0 descriptor?? [ 1468.624169][T14807] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 1468.773854][T14807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1468.773875][T14807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1468.773896][T14807] usb 2-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1468.773908][T14807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1468.803289][T14807] usb 2-1: config 0 descriptor?? [ 1468.850253][ T5820] rc_core: IR keymap rc-hauppauge not found [ 1468.850275][ T5820] Registered IR keymap rc-empty [ 1468.850656][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1468.857617][T19292] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3953'. [ 1468.872735][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.264031][T14807] usbhid 2-1:0.0: can't add hid device: -71 [ 1469.264113][T14807] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1469.281861][T14807] usb 2-1: USB disconnect, device number 68 [ 1469.324956][ T5820] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 1469.352564][ T5820] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input81 [ 1469.427277][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.440558][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.460735][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.481216][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.500389][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.520435][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.540398][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.560414][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.580414][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.600384][ T5820] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.633108][ T5820] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1469.633735][ T5820] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1469.757039][ T5820] usb 7-1: USB disconnect, device number 23 [ 1471.812058][T19318] netlink: 108 bytes leftover after parsing attributes in process `syz.7.3961'. [ 1472.463939][T19328] netlink: 'syz.6.3966': attribute type 1 has an invalid length. [ 1472.463962][T19328] netlink: 924 bytes leftover after parsing attributes in process `syz.6.3966'. [ 1472.620328][ T10] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 1473.065208][T19330] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3967'. [ 1473.192579][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1473.192622][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1473.192657][ T10] usb 2-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1473.192677][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.283983][ T10] usb 2-1: config 0 descriptor?? [ 1473.535623][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 1473.535715][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1473.546001][ T10] usb 2-1: USB disconnect, device number 69 [ 1475.582242][T19354] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3974'. [ 1477.690705][T19365] netlink: 'syz.7.3978': attribute type 1 has an invalid length. [ 1477.690730][T19365] netlink: 924 bytes leftover after parsing attributes in process `syz.7.3978'. [ 1478.459593][T19383] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3981'. [ 1478.525213][T19384] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3981'. [ 1478.733613][T19383] team1: entered promiscuous mode [ 1478.733631][T19383] team1: entered allmulticast mode [ 1478.734116][T19383] 8021q: adding VLAN 0 to HW filter on device team1 [ 1478.780379][ T5820] usb 8-1: new full-speed USB device number 41 using dummy_hcd [ 1478.917885][T19384] team2: entered promiscuous mode [ 1478.917907][T19384] team2: entered allmulticast mode [ 1478.918317][T19384] 8021q: adding VLAN 0 to HW filter on device team2 [ 1478.954193][ T5820] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1478.954215][ T5820] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1478.954238][ T5820] usb 8-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1478.954252][ T5820] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1478.971821][ T5820] usb 8-1: config 0 descriptor?? [ 1479.512716][T14807] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1479.671063][T14807] usb 6-1: Using ep0 maxpacket: 16 [ 1479.695486][T14807] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1479.695589][T14807] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1479.695619][T14807] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1479.695640][T14807] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1479.695653][T14807] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1479.696916][T14807] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1479.697023][T14807] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1479.697044][T14807] usb 6-1: Manufacturer: syz [ 1479.801747][T14807] usb 6-1: config 0 descriptor?? [ 1480.310252][T14807] rc_core: IR keymap rc-hauppauge not found [ 1480.310271][T14807] Registered IR keymap rc-empty [ 1480.310411][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.339479][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.359211][T14807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1480.391898][T14807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input85 [ 1480.551322][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.574349][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.592556][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.616991][T19398] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3989'. [ 1480.617371][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1480.646905][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.088325][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.104293][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.120551][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.140426][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.160332][T14807] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1481.183176][T14807] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1481.183195][T14807] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1481.229914][T14807] usb 6-1: USB disconnect, device number 29 [ 1482.216246][T19409] netlink: 'syz.5.3992': attribute type 1 has an invalid length. [ 1482.216282][T19409] netlink: 704 bytes leftover after parsing attributes in process `syz.5.3992'. [ 1482.333526][T19412] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 1482.333696][T19412] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1482.339645][T19412] vhci_hcd vhci_hcd.0: Device attached [ 1482.570845][T14807] usb 45-1: new low-speed USB device number 4 using vhci_hcd [ 1482.614887][T19414] vhci_hcd: connection reset by peer [ 1482.618161][ T12] vhci_hcd vhci_hcd.6: stop threads [ 1482.618187][ T12] vhci_hcd vhci_hcd.6: release socket [ 1482.618421][ T12] vhci_hcd vhci_hcd.6: disconnect device [ 1482.704772][ T5820] usbhid 8-1:0.0: can't add hid device: -71 [ 1482.704848][ T5820] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1482.733329][ T5820] usb 8-1: USB disconnect, device number 41 [ 1482.757843][T19419] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3995'. [ 1484.495394][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.495463][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.805352][T19436] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4001'. [ 1485.881731][T19446] netlink: 'syz.7.4004': attribute type 1 has an invalid length. [ 1485.881755][T19446] netlink: 704 bytes leftover after parsing attributes in process `syz.7.4004'. [ 1486.426112][T19444] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1486.426112][T19444] program syz.2.4003 not setting count and/or reply_len properly [ 1487.030350][ T10] usb 7-1: new full-speed USB device number 24 using dummy_hcd [ 1487.085092][T19461] usb usb8: usbfs: process 19461 (syz.7.4007) did not claim interface 0 before use [ 1487.204730][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1487.204763][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1487.204801][ T10] usb 7-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1487.204823][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.273390][ T10] usb 7-1: config 0 descriptor?? [ 1488.360385][T14807] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 1489.362275][T19476] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4012'. [ 1491.341871][ T10] usbhid 7-1:0.0: can't add hid device: -71 [ 1491.341954][ T10] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1491.374536][ T10] usb 7-1: USB disconnect, device number 24 [ 1492.197574][T19492] netlink: 'syz.1.4017': attribute type 1 has an invalid length. [ 1492.197598][T19492] netlink: 704 bytes leftover after parsing attributes in process `syz.1.4017'. [ 1492.240438][ T10] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 1492.433694][ T10] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1492.433734][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1492.463856][ T10] usb 7-1: config 0 descriptor?? [ 1492.506399][T19498] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4019'. [ 1493.944947][T19508] syz.6.4015: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz6,mems_allowed=0-1 [ 1493.945075][T19508] CPU: 0 UID: 0 PID: 19508 Comm: syz.6.4015 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1493.945104][T19508] Tainted: [L]=SOFTLOCKUP [ 1493.945108][T19508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1493.945116][T19508] Call Trace: [ 1493.945130][T19508] [ 1493.945136][T19508] dump_stack_lvl+0xe8/0x150 [ 1493.945160][T19508] warn_alloc+0x263/0x3e0 [ 1493.945171][T19508] ? kasan_save_track+0x4f/0x80 [ 1493.945187][T19508] ? kasan_save_track+0x3e/0x80 [ 1493.945200][T19508] ? kasan_save_free_info+0x46/0x50 [ 1493.945212][T19508] ? __kasan_slab_free+0x5c/0x80 [ 1493.945226][T19508] ? tomoyo_path_number_perm+0x501/0x630 [ 1493.945247][T19508] ? security_file_ioctl+0xc3/0x2a0 [ 1493.945263][T19508] ? __se_sys_ioctl+0x47/0x170 [ 1493.945282][T19508] ? __pfx_warn_alloc+0x10/0x10 [ 1493.945303][T19508] __vmalloc_node_range_noprof+0x132/0x1750 [ 1493.945320][T19508] ? register_lock_class+0x31/0x2e0 [ 1493.945344][T19508] ? __lock_acquire+0x6b5/0x2cf0 [ 1493.945361][T19508] ? kasan_quarantine_put+0xbb/0x1f0 [ 1493.945382][T19508] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1493.945419][T19508] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1493.945442][T19508] vmalloc_noprof+0xb2/0xe0 [ 1493.945471][T19508] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1493.945491][T19508] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1493.945511][T19508] ? dvb_demux_do_ioctl+0x323/0x540 [ 1493.945544][T19508] dvb_demux_do_ioctl+0x460/0x540 [ 1493.945581][T19508] dvb_usercopy+0x199/0x2e0 [ 1493.945606][T19508] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1493.945636][T19508] ? __pfx_dvb_usercopy+0x10/0x10 [ 1493.945675][T19508] ? __fget_files+0x3a6/0x420 [ 1493.945699][T19508] ? __fget_files+0x2a/0x420 [ 1493.945727][T19508] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1493.945759][T19508] dvb_demux_ioctl+0x29/0x40 [ 1493.945799][T19508] __se_sys_ioctl+0xff/0x170 [ 1493.945829][T19508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1493.945851][T19508] do_syscall_64+0x15f/0xf80 [ 1493.945873][T19508] ? trace_irq_disable+0x3b/0x140 [ 1493.945893][T19508] ? clear_bhb_loop+0x40/0x90 [ 1493.945917][T19508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1493.945937][T19508] RIP: 0033:0x7f3e59a6c819 [ 1493.945956][T19508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1493.945973][T19508] RSP: 002b:00007f3e57c84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1493.945994][T19508] RAX: ffffffffffffffda RBX: 00007f3e59ce6180 RCX: 00007f3e59a6c819 [ 1493.946009][T19508] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000006 [ 1493.946023][T19508] RBP: 00007f3e59b02c91 R08: 0000000000000000 R09: 0000000000000000 [ 1493.946036][T19508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1493.946049][T19508] R13: 00007f3e59ce6218 R14: 00007f3e59ce6180 R15: 00007fff51c40d28 [ 1493.946081][T19508] [ 1493.975432][T19508] Mem-Info: [ 1493.975447][T19508] active_anon:268 inactive_anon:9657 isolated_anon:0 [ 1493.975447][T19508] active_file:26040 inactive_file:35495 isolated_file:0 [ 1493.975447][T19508] unevictable:768 dirty:122 writeback:0 [ 1493.975447][T19508] slab_reclaimable:12622 slab_unreclaimable:108146 [ 1493.975447][T19508] mapped:32639 shmem:4243 pagetables:1508 [ 1493.975447][T19508] sec_pagetables:0 bounce:0 [ 1493.975447][T19508] kernel_misc_reclaimable:0 [ 1493.975447][T19508] free:1295714 free_pcp:3710 free_cma:0 [ 1493.975561][T19508] Node 0 active_anon:1072kB inactive_anon:38628kB active_file:103956kB inactive_file:141980kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:130556kB dirty:488kB writeback:0kB shmem:15436kB kernel_stack:13948kB pagetables:5856kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1493.975615][T19508] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1493.975714][T19508] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1493.975786][T19508] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1493.975871][T19508] Node 0 DMA32 free:1228572kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1072kB inactive_anon:38628kB active_file:103956kB inactive_file:141980kB unevictable:1536kB writepending:488kB zspages:0kB present:3129332kB managed:2565008kB mlocked:0kB bounce:0kB free_pcp:14840kB local_pcp:6848kB free_cma:0kB [ 1493.975936][T19508] lowmem_reserve[]: 0 0 0 0 0 [ 1493.975969][T19508] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1493.976078][T19508] lowmem_reserve[]: 0 0 0 0 0 [ 1493.976112][T19508] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1493.976172][T19508] lowmem_reserve[]: 0 0 0 0 0 [ 1493.976253][T19508] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1493.976454][T19508] Node 0 DMA32: 1998*4kB (UM) 2174*8kB (UM) 2799*16kB (UME) 879*32kB (UME) 724*64kB (UME) 657*128kB (UME) 439*256kB (UM) 270*512kB (UM) 128*1024kB (UME) 62*2048kB (UM) 120*4096kB (UM) = 1228920kB [ 1494.173873][T19508] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1494.174832][T19508] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1494.181082][T19508] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1494.181101][T19508] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1494.181117][T19508] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1494.186555][T19508] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1494.186578][T19508] 62924 total pagecache pages [ 1494.186586][T19508] 0 pages in swap cache [ 1494.186593][T19508] Free swap = 124996kB [ 1494.186601][T19508] Total swap = 124996kB [ 1494.186610][T19508] 2097051 pages RAM [ 1494.186616][T19508] 0 pages HighMem/MovableOnly [ 1494.186624][T19508] 424150 pages reserved [ 1494.186630][T19508] 0 pages cma reserved [ 1495.298533][T19504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1495.298564][T19504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1495.430292][T19504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1495.430371][T19504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1496.380314][ T9] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 1496.515663][ T10] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1496.517825][ T10] [drm:udl_init] *ERROR* Selecting channel failed [ 1496.550592][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1496.550614][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1496.550636][ T9] usb 6-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1496.550650][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1496.737334][T19527] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4026'. [ 1497.543136][ T9] usb 6-1: config 0 descriptor?? [ 1497.691562][ T10] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 2 [ 1497.691591][ T10] [drm] Initialized udl on minor 2 [ 1497.694412][T19530] netlink: 'syz.6.4028': attribute type 1 has an invalid length. [ 1497.694434][T19530] netlink: 704 bytes leftover after parsing attributes in process `syz.6.4028'. [ 1498.037988][ T10] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1498.240440][ T5820] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1498.392134][ T10] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1498.470995][ T5820] usb 2-1: Using ep0 maxpacket: 16 [ 1498.531285][ T5820] usb 2-1: config 0 has no interfaces? [ 1498.538219][ T5820] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1498.538250][ T5820] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1498.538271][ T5820] usb 2-1: Manufacturer: syz [ 1498.635800][ T5820] usb 2-1: config 0 descriptor?? [ 1498.696089][ T10] usb 7-1: USB disconnect, device number 25 [ 1498.734228][T14296] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 1498.834207][T14296] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1500.018983][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 1500.019118][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1500.112513][ T9] usb 6-1: USB disconnect, device number 30 [ 1500.231401][ T10] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 1500.392564][ T10] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1500.392597][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1500.455770][ T10] usb 7-1: config 0 descriptor?? [ 1501.041239][ T10] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1501.041723][ T10] [drm:udl_init] *ERROR* Selecting channel failed [ 1501.155958][ T10] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 2 [ 1501.155976][ T10] [drm] Initialized udl on minor 2 [ 1501.172216][ T10] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1501.187467][ T10] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1501.188580][ T9] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1501.283020][ T10] usb 7-1: USB disconnect, device number 26 [ 1501.323101][ T9] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1501.323270][ T9] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1501.970478][T14296] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1502.131910][T14296] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1502.131932][T14296] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1502.136302][T14296] usb 6-1: config 0 descriptor?? [ 1502.184204][T19576] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4042'. [ 1502.200696][T19582] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4043'. [ 1503.453891][T14296] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1503.454281][T14296] [drm:udl_init] *ERROR* Selecting channel failed [ 1503.755711][T14296] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 1503.755729][T14296] [drm] Initialized udl on minor 2 [ 1503.759355][T14296] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1503.760122][T14296] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1503.872501][T14807] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1503.872644][T14807] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1503.891471][T14296] usb 6-1: USB disconnect, device number 31 [ 1504.460322][T14807] usb 2-1: USB disconnect, device number 70 [ 1505.600351][ T5889] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1505.750379][ T5889] usb 6-1: Using ep0 maxpacket: 16 [ 1505.752566][ T5889] usb 6-1: config 0 has no interfaces? [ 1505.758366][ T5889] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1505.758395][ T5889] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1505.758416][ T5889] usb 6-1: Manufacturer: syz [ 1505.823694][ T5889] usb 6-1: config 0 descriptor?? [ 1505.824949][T14807] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 1505.955630][T19626] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4058'. [ 1505.980289][T14807] usb 8-1: Using ep0 maxpacket: 16 [ 1505.986890][T14807] usb 8-1: config 0 has no interfaces? [ 1505.988744][T14807] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1505.988773][T14807] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1505.988792][T14807] usb 8-1: Manufacturer: syz [ 1506.039223][T14807] usb 8-1: config 0 descriptor?? [ 1506.969989][T19651] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 1506.970018][T19651] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1506.974209][T19651] vhci_hcd vhci_hcd.0: Device attached [ 1507.115819][T19652] vhci_hcd: connection closed [ 1507.122753][ T1038] vhci_hcd vhci_hcd.2: stop threads [ 1507.122782][ T1038] vhci_hcd vhci_hcd.2: release socket [ 1507.122819][ T1038] vhci_hcd vhci_hcd.2: disconnect device [ 1507.271983][ T5889] usb 8-1: USB disconnect, device number 42 [ 1507.444395][T19613] Set syz1 is full, maxelem 6117 reached [ 1507.502096][ T10] usb 6-1: USB disconnect, device number 32 [ 1507.686903][T19675] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4076'. [ 1507.720435][T14807] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 1508.162776][T14807] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1508.162811][T14807] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1508.162852][T14807] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1508.162876][T14807] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1508.168380][T14807] usb 7-1: config 0 descriptor?? [ 1508.352098][T19685] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(3) [ 1508.352127][T19685] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1508.352229][T19685] vhci_hcd vhci_hcd.0: Device attached [ 1508.695307][ T5889] usb 47-1: new low-speed USB device number 5 using vhci_hcd [ 1508.735210][T19686] vhci_hcd: connection reset by peer [ 1508.736837][ T1038] vhci_hcd vhci_hcd.7: stop threads [ 1508.736864][ T1038] vhci_hcd vhci_hcd.7: release socket [ 1508.736930][ T1038] vhci_hcd vhci_hcd.7: disconnect device [ 1508.810658][ C0] raw-gadget.1 gadget.6: ignoring, device is not running [ 1508.811083][T14807] usbhid 7-1:0.0: can't add hid device: -32 [ 1508.811209][T14807] usbhid 7-1:0.0: probe with driver usbhid failed with error -32 [ 1508.817037][T14807] usb 7-1: USB disconnect, device number 27 [ 1508.942906][T19702] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 1508.942934][T19702] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1508.943047][T19702] vhci_hcd vhci_hcd.0: Device attached [ 1509.042249][T19703] vhci_hcd: connection closed [ 1509.044397][T19243] vhci_hcd vhci_hcd.2: stop threads [ 1509.044424][T19243] vhci_hcd vhci_hcd.2: release socket [ 1509.044463][T19243] vhci_hcd vhci_hcd.2: disconnect device [ 1509.060424][ T5882] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1509.230291][ T5882] usb 6-1: Using ep0 maxpacket: 16 [ 1509.232240][ T5882] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1509.232294][ T5882] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1509.232322][ T5882] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1509.232337][ T5882] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1509.232350][ T5882] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1509.234317][ T5882] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1509.234346][ T5882] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1509.234366][ T5882] usb 6-1: Manufacturer: syz [ 1509.238017][ T5882] usb 6-1: config 0 descriptor?? [ 1509.610283][ T5882] rc_core: IR keymap rc-hauppauge not found [ 1509.610306][ T5882] Registered IR keymap rc-empty [ 1509.610452][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1509.632359][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.060079][ T5882] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1510.074639][ T5882] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input87 [ 1510.103855][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.120620][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.146960][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.160587][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.190562][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.211059][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.255513][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.273465][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.303723][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.330785][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.352403][ T5882] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1510.394385][ T5882] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version f0 [ 1510.394412][ T5882] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1510.427923][ T5882] usb 6-1: USB disconnect, device number 33 [ 1510.474949][T19721] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4094'. [ 1511.107264][T19752] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 1511.107293][T19752] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1511.110107][T19752] vhci_hcd vhci_hcd.0: Device attached [ 1511.340268][T14296] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 1511.360586][T19755] vhci_hcd: connection reset by peer [ 1511.364697][ T1024] vhci_hcd vhci_hcd.5: stop threads [ 1511.364724][ T1024] vhci_hcd vhci_hcd.5: release socket [ 1511.364798][ T1024] vhci_hcd vhci_hcd.5: disconnect device [ 1512.662575][T19787] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4119'. [ 1514.050387][ T5889] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 1514.251509][T19813] fuse: Unknown parameter 'user_id00000000000000000000' [ 1514.355910][T19821] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4136'. [ 1515.260390][ T5890] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1515.415095][ T5890] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1515.415127][ T5890] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1515.502499][ T5890] usb 7-1: config 0 descriptor?? [ 1515.747515][T19828] warn_alloc: 2 callbacks suppressed [ 1515.747533][T19828] syz.6.4138: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz6,mems_allowed=0-1 [ 1515.747599][T19828] CPU: 0 UID: 0 PID: 19828 Comm: syz.6.4138 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1515.747627][T19828] Tainted: [L]=SOFTLOCKUP [ 1515.747634][T19828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1515.747645][T19828] Call Trace: [ 1515.747653][T19828] [ 1515.747663][T19828] dump_stack_lvl+0xe8/0x150 [ 1515.747702][T19828] warn_alloc+0x263/0x3e0 [ 1515.747723][T19828] ? kasan_save_track+0x4f/0x80 [ 1515.747752][T19828] ? kasan_save_track+0x3e/0x80 [ 1515.747778][T19828] ? kasan_save_free_info+0x46/0x50 [ 1515.747802][T19828] ? __kasan_slab_free+0x5c/0x80 [ 1515.747831][T19828] ? tomoyo_path_number_perm+0x501/0x630 [ 1515.747859][T19828] ? security_file_ioctl+0xc3/0x2a0 [ 1515.747888][T19828] ? __se_sys_ioctl+0x47/0x170 [ 1515.747923][T19828] ? __pfx_warn_alloc+0x10/0x10 [ 1515.747964][T19828] __vmalloc_node_range_noprof+0x132/0x1750 [ 1515.747995][T19828] ? register_lock_class+0x31/0x2e0 [ 1515.748025][T19828] ? __lock_acquire+0x6b5/0x2cf0 [ 1515.748062][T19828] ? kasan_quarantine_put+0xbb/0x1f0 [ 1515.748104][T19828] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1515.748149][T19828] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1515.748173][T19828] vmalloc_noprof+0xb2/0xe0 [ 1515.748203][T19828] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1515.748227][T19828] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1515.748249][T19828] ? dvb_demux_do_ioctl+0x323/0x540 [ 1515.748297][T19828] dvb_demux_do_ioctl+0x460/0x540 [ 1515.748336][T19828] dvb_usercopy+0x199/0x2e0 [ 1515.748367][T19828] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1515.748400][T19828] ? __pfx_dvb_usercopy+0x10/0x10 [ 1515.748443][T19828] ? __fget_files+0x3a6/0x420 [ 1515.748469][T19828] ? __fget_files+0x2a/0x420 [ 1515.748498][T19828] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1515.748530][T19828] dvb_demux_ioctl+0x29/0x40 [ 1515.748564][T19828] __se_sys_ioctl+0xff/0x170 [ 1515.748596][T19828] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.748620][T19828] do_syscall_64+0x15f/0xf80 [ 1515.748647][T19828] ? trace_irq_disable+0x3b/0x140 [ 1515.748670][T19828] ? clear_bhb_loop+0x40/0x90 [ 1515.748697][T19828] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.748719][T19828] RIP: 0033:0x7f3e59a6c819 [ 1515.748739][T19828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1515.748758][T19828] RSP: 002b:00007f3e57cc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1515.748781][T19828] RAX: ffffffffffffffda RBX: 00007f3e59ce5fa0 RCX: 00007f3e59a6c819 [ 1515.748797][T19828] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000006 [ 1515.748812][T19828] RBP: 00007f3e59b02c91 R08: 0000000000000000 R09: 0000000000000000 [ 1515.748826][T19828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1515.748839][T19828] R13: 00007f3e59ce6038 R14: 00007f3e59ce5fa0 R15: 00007fff51c40d28 [ 1515.748873][T19828] [ 1515.781482][T19828] Mem-Info: [ 1515.781500][T19828] active_anon:268 inactive_anon:6807 isolated_anon:0 [ 1515.781500][T19828] active_file:26049 inactive_file:35494 isolated_file:0 [ 1515.781500][T19828] unevictable:768 dirty:262 writeback:50 [ 1515.781500][T19828] slab_reclaimable:12629 slab_unreclaimable:106313 [ 1515.781500][T19828] mapped:29941 shmem:1371 pagetables:1532 [ 1515.781500][T19828] sec_pagetables:0 bounce:0 [ 1515.781500][T19828] kernel_misc_reclaimable:0 [ 1515.781500][T19828] free:1292666 free_pcp:11203 free_cma:0 [ 1515.781569][T19828] Node 0 active_anon:1072kB inactive_anon:27228kB active_file:103992kB inactive_file:141976kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:119764kB dirty:1048kB writeback:200kB shmem:3948kB kernel_stack:13744kB pagetables:5952kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1515.782179][T19828] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1515.782233][T19828] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1515.782350][T19828] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1515.782387][T19828] Node 0 DMA32 free:1216380kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1072kB inactive_anon:27228kB active_file:103992kB inactive_file:141976kB unevictable:1536kB writepending:1148kB zspages:0kB present:3129332kB managed:2565008kB mlocked:0kB bounce:0kB free_pcp:44808kB local_pcp:7168kB free_cma:0kB [ 1515.782453][T19828] lowmem_reserve[]: 0 0 0 0 0 [ 1515.782538][T19828] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1515.782603][T19828] lowmem_reserve[]: 0 0 0 0 0 [ 1515.782846][T19828] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1515.782909][T19828] lowmem_reserve[]: 0 0 0 0 0 [ 1515.782993][T19828] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1515.783655][T19828] Node 0 DMA32: 3228*4kB (UM) 2235*8kB (UME) 2213*16kB (UM) 573*32kB (UM) 720*64kB (UME) 669*128kB (UME) 441*256kB (UM) 271*512kB (UM) 127*1024kB (UME) 62*2048kB (UM) 120*4096kB (UM) = 1216440kB [ 1515.784703][T19828] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1515.786119][T19828] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1515.787750][T19828] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1515.787770][T19828] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1515.787788][T19828] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1515.788771][T19828] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1515.788843][T19828] 62910 total pagecache pages [ 1515.788852][T19828] 0 pages in swap cache [ 1515.788861][T19828] Free swap = 124996kB [ 1515.788869][T19828] Total swap = 124996kB [ 1515.788879][T19828] 2097051 pages RAM [ 1515.788897][T19828] 0 pages HighMem/MovableOnly [ 1515.788906][T19828] 424150 pages reserved [ 1515.788913][T19828] 0 pages cma reserved [ 1516.070807][ T5890] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1516.073010][ T5890] [drm:udl_init] *ERROR* Selecting channel failed [ 1516.245028][ T5890] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 2 [ 1516.245053][ T5890] [drm] Initialized udl on minor 2 [ 1516.262144][ T5890] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1516.262610][ T5890] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1516.308985][ T5889] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1516.320815][ T5889] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1516.321677][ T5889] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1516.339607][ T5890] usb 7-1: USB disconnect, device number 28 [ 1516.480542][T14296] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 1520.506372][T19935] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1522.465476][T17650] Bluetooth: hci3: command 0x0406 tx timeout [ 1523.387758][T19996] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4208'. [ 1523.473524][T19996] team1: entered promiscuous mode [ 1523.473558][T19996] team1: entered allmulticast mode [ 1523.474021][T19996] 8021q: adding VLAN 0 to HW filter on device team1 [ 1523.532996][T20001] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4208'. [ 1523.615474][T20001] team2: entered promiscuous mode [ 1523.615503][T20001] team2: entered allmulticast mode [ 1523.616089][T20001] 8021q: adding VLAN 0 to HW filter on device team2 [ 1524.737645][T20013] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4214'. [ 1527.817302][T20074] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4238'. [ 1527.829422][T14807] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 1527.998021][T14807] usb 8-1: Using ep0 maxpacket: 16 [ 1528.063029][T14807] usb 8-1: config 0 has no interfaces? [ 1528.064359][T14807] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1528.064387][T14807] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1528.064406][T14807] usb 8-1: Manufacturer: syz [ 1528.111179][T14807] usb 8-1: config 0 descriptor?? [ 1529.525892][T20118] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 1529.525922][T20118] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1529.546626][T20118] vhci_hcd vhci_hcd.0: Device attached [ 1530.519912][T20119] vhci_hcd: connection closed [ 1530.540604][T19243] vhci_hcd vhci_hcd.5: stop threads [ 1530.540632][T19243] vhci_hcd vhci_hcd.5: release socket [ 1530.540671][T19243] vhci_hcd vhci_hcd.5: disconnect device [ 1530.734168][T20067] Set syz1 is full, maxelem 6117 reached [ 1530.758142][T14807] usb 8-1: USB disconnect, device number 43 [ 1535.739017][T20198] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1535.739017][T20198] program syz.5.4286 not setting count and/or reply_len properly [ 1535.799164][T20200] netlink: 5 bytes leftover after parsing attributes in process `syz.7.4288'. [ 1535.815037][T20200] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1536.200242][T15235] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 1536.362204][T15235] usb 8-1: config 0 has no interfaces? [ 1536.362240][T15235] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1536.362258][T15235] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1536.366445][T15235] usb 8-1: config 0 descriptor?? [ 1536.702465][T15235] usb 8-1: string descriptor 0 read error: -71 [ 1536.717299][T15235] usb 8-1: USB disconnect, device number 44 [ 1537.264906][T20231] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4301'. [ 1538.714141][ T5882] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 1538.887670][ T5882] usb 8-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1538.887691][ T5882] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1538.927684][ T5882] usb 8-1: config 0 descriptor?? [ 1539.286479][T20248] syz.7.4307: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz7,mems_allowed=0-1 [ 1539.286554][T20248] CPU: 1 UID: 0 PID: 20248 Comm: syz.7.4307 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1539.286588][T20248] Tainted: [L]=SOFTLOCKUP [ 1539.286596][T20248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1539.286610][T20248] Call Trace: [ 1539.286619][T20248] [ 1539.286630][T20248] dump_stack_lvl+0xe8/0x150 [ 1539.286670][T20248] warn_alloc+0x263/0x3e0 [ 1539.286703][T20248] ? __pfx_warn_alloc+0x10/0x10 [ 1539.286732][T20248] ? __schedule+0x1697/0x54c0 [ 1539.286841][T20248] __vmalloc_node_range_noprof+0x132/0x1750 [ 1539.286875][T20248] ? register_lock_class+0x31/0x2e0 [ 1539.286905][T20248] ? __lock_acquire+0x6b5/0x2cf0 [ 1539.286938][T20248] ? kasan_quarantine_put+0xbb/0x1f0 [ 1539.286965][T20248] ? __pfx___schedule+0x10/0x10 [ 1539.286995][T20248] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1539.287043][T20248] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1539.287067][T20248] vmalloc_noprof+0xb2/0xe0 [ 1539.287098][T20248] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1539.287123][T20248] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1539.287145][T20248] ? dvb_demux_do_ioctl+0x323/0x540 [ 1539.287183][T20248] dvb_demux_do_ioctl+0x460/0x540 [ 1539.287229][T20248] dvb_usercopy+0x199/0x2e0 [ 1539.287260][T20248] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1539.287293][T20248] ? __pfx_dvb_usercopy+0x10/0x10 [ 1539.287336][T20248] ? __fget_files+0x3a6/0x420 [ 1539.287362][T20248] ? __fget_files+0x2a/0x420 [ 1539.287392][T20248] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1539.287425][T20248] dvb_demux_ioctl+0x29/0x40 [ 1539.287459][T20248] __se_sys_ioctl+0xff/0x170 [ 1539.287491][T20248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.287511][T20248] do_syscall_64+0x15f/0xf80 [ 1539.287538][T20248] ? clear_bhb_loop+0x40/0x90 [ 1539.287564][T20248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.287585][T20248] RIP: 0033:0x7fa4f771c819 [ 1539.287605][T20248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1539.287623][T20248] RSP: 002b:00007fa4f5976028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1539.287645][T20248] RAX: ffffffffffffffda RBX: 00007fa4f7995fa0 RCX: 00007fa4f771c819 [ 1539.287661][T20248] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000006 [ 1539.287676][T20248] RBP: 00007fa4f77b2c91 R08: 0000000000000000 R09: 0000000000000000 [ 1539.287691][T20248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1539.287704][T20248] R13: 00007fa4f7996038 R14: 00007fa4f7995fa0 R15: 00007ffda6716598 [ 1539.287738][T20248] [ 1539.287875][T20248] Mem-Info: [ 1539.287886][T20248] active_anon:268 inactive_anon:7013 isolated_anon:0 [ 1539.287886][T20248] active_file:26061 inactive_file:35493 isolated_file:0 [ 1539.287886][T20248] unevictable:768 dirty:203 writeback:0 [ 1539.287886][T20248] slab_reclaimable:12718 slab_unreclaimable:107140 [ 1539.287886][T20248] mapped:35089 shmem:1371 pagetables:1628 [ 1539.287886][T20248] sec_pagetables:0 bounce:0 [ 1539.287886][T20248] kernel_misc_reclaimable:0 [ 1539.287886][T20248] free:1298919 free_pcp:5421 free_cma:0 [ 1539.288002][T20248] Node 0 active_anon:1072kB inactive_anon:28052kB active_file:104040kB inactive_file:141972kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:140356kB dirty:812kB writeback:0kB shmem:3948kB kernel_stack:13916kB pagetables:6336kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1539.288058][T20248] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1539.288162][T20248] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1539.288233][T20248] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1539.288323][T20248] Node 0 DMA32 free:1241392kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1072kB inactive_anon:28052kB active_file:104040kB inactive_file:141972kB unevictable:1536kB writepending:812kB zspages:0kB present:3129332kB managed:2565008kB mlocked:0kB bounce:0kB free_pcp:21684kB local_pcp:17580kB free_cma:0kB [ 1539.288389][T20248] lowmem_reserve[]: 0 0 0 0 0 [ 1539.288424][T20248] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1539.288539][T20248] lowmem_reserve[]: 0 0 0 0 0 [ 1539.288574][T20248] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1539.288692][T20248] lowmem_reserve[]: 0 0 0 0 0 [ 1539.288728][T20248] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1539.288903][T20248] Node 0 DMA32: 5037*4kB (UM) 4148*8kB (UME) 3148*16kB (UME) 772*32kB (UME) 471*64kB (UME) 657*128kB (UME) 441*256kB (UM) 274*512kB (UM) 126*1024kB (UME) 61*2048kB (UM) 120*4096kB (UM) = 1241300kB [ 1539.289189][T20248] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1539.289355][T20248] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1539.289572][T20248] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1539.289591][T20248] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1539.289656][T20248] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1539.289688][T20248] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1539.289722][T20248] 62921 total pagecache pages [ 1539.289731][T20248] 0 pages in swap cache [ 1539.289740][T20248] Free swap = 124996kB [ 1539.289748][T20248] Total swap = 124996kB [ 1539.289757][T20248] 2097051 pages RAM [ 1539.289817][T20248] 0 pages HighMem/MovableOnly [ 1539.289826][T20248] 424150 pages reserved [ 1539.289834][T20248] 0 pages cma reserved [ 1539.618302][ T5882] udl 8-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1539.638723][ T5882] [drm:udl_init] *ERROR* Selecting channel failed [ 1539.818520][T20269] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4316'. [ 1540.742547][T20274] fuse: Unknown parameter '0x0000000000000003' [ 1540.764134][ T5882] [drm] Initialized udl 0.0.1 for 8-1:0.0 on minor 2 [ 1540.765447][ T5882] [drm] Initialized udl on minor 2 [ 1540.768450][ T5882] udl 8-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1540.769329][ T5882] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 1540.819107][ T5882] usb 8-1: USB disconnect, device number 45 [ 1540.830075][ T5890] udl 8-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 1540.845423][ T5890] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 1541.480318][ T10] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1541.630290][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 1541.648769][ T10] usb 3-1: config 0 has an invalid descriptor of length 196, skipping remainder of the config [ 1541.648828][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1541.648858][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1541.648880][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1541.648913][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1541.723011][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1541.723042][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1541.723063][ T10] usb 3-1: Manufacturer: syz [ 1541.766214][ T10] usb 3-1: config 0 descriptor?? [ 1543.853905][T20312] netlink: 56 bytes leftover after parsing attributes in process `syz.7.4332'. [ 1544.040271][ T10] rc_core: IR keymap rc-hauppauge not found [ 1544.040292][ T10] Registered IR keymap rc-empty [ 1544.040444][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.328020][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.354464][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1544.382294][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input89 [ 1544.420397][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.440510][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.460410][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.481178][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.501053][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.520580][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.545667][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.560352][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.581070][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.600327][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1544.629000][ T10] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1544.629017][ T10] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1544.682497][ T10] usb 3-1: USB disconnect, device number 54 [ 1545.061410][T20333] binder: 20331:20333 ioctl 4018620d 0 returned -22 [ 1545.181880][T20332] usb usb8: usbfs: process 20332 (syz.6.4339) did not claim interface 0 before use [ 1545.249407][T20338] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4343'. [ 1545.794629][T20346] fuse: Bad value for 'fd' [ 1545.944332][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.289202][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1551.610324][T14807] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 1551.760288][T14807] usb 8-1: Using ep0 maxpacket: 16 [ 1551.951244][T14807] usb 8-1: config 0 has an invalid descriptor of length 248, skipping remainder of the config [ 1551.951303][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1551.951332][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1551.951355][T14807] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1551.951379][T14807] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1551.953584][T14807] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1551.953614][T14807] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1551.953635][T14807] usb 8-1: Manufacturer: syz [ 1553.024059][T14807] usb 8-1: config 0 descriptor?? [ 1554.466421][T20399] fuse: Unknown parameter 'fd0x0000000000000003' [ 1554.500498][T14807] rc_core: IR keymap rc-hauppauge not found [ 1554.500518][T14807] Registered IR keymap rc-empty [ 1554.500664][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.529709][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.543268][T14807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1554.570846][T14807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input92 [ 1554.610505][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.630363][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.651155][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.655819][T20408] tipc: Started in network mode [ 1554.655853][T20408] tipc: Node identity 6edea8d4498c, cluster identity 4711 [ 1554.671035][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.695819][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.708454][T20408] tipc: Enabled bearer , priority 0 [ 1554.717010][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.728336][T20408] syzkaller0: entered promiscuous mode [ 1554.728362][T20408] syzkaller0: entered allmulticast mode [ 1554.735938][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.751751][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.758945][T20408] tipc: Resetting bearer [ 1554.785584][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.800389][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1554.822881][T20405] tipc: Resetting bearer [ 1554.825738][T14807] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1554.825764][T14807] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1554.860092][T14807] usb 8-1: USB disconnect, device number 46 [ 1555.015301][T20405] tipc: Disabling bearer [ 1556.660318][ T5882] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 1556.990306][ T5882] usb 8-1: Using ep0 maxpacket: 16 [ 1556.992515][ T5882] usb 8-1: config 0 has an invalid descriptor of length 248, skipping remainder of the config [ 1556.992566][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1556.992595][ T5882] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1556.992616][ T5882] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1556.992640][ T5882] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1556.993913][ T5882] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1556.993940][ T5882] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1556.993961][ T5882] usb 8-1: Manufacturer: syz [ 1557.986551][ T5882] usb 8-1: config 0 descriptor?? [ 1558.178763][T20463] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1558.347065][T20471] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1558.347065][T20471] program syz.2.4390 not setting count and/or reply_len properly [ 1558.367665][ T5882] rc_core: IR keymap rc-hauppauge not found [ 1558.367688][ T5882] Registered IR keymap rc-empty [ 1558.368331][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.380454][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.416841][ T5882] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1558.440563][ T5882] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input93 [ 1558.471970][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.490656][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.522178][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.540477][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.560351][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.580881][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.611925][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.646024][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.660719][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.690459][ T5882] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1558.726457][ T5882] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1558.726474][ T5882] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1558.802690][ T5882] usb 8-1: USB disconnect, device number 47 [ 1558.829016][T20483] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 1558.829035][T20483] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1558.829095][T20483] vhci_hcd vhci_hcd.0: Device attached [ 1559.043654][T20484] vhci_hcd: connection closed [ 1559.058408][ T43] vhci_hcd vhci_hcd.6: stop threads [ 1559.058436][ T43] vhci_hcd vhci_hcd.6: release socket [ 1559.058613][ T43] vhci_hcd vhci_hcd.6: disconnect device [ 1559.081468][ T5889] usb 45-1: new low-speed USB device number 5 using vhci_hcd [ 1559.081537][ T5889] usb 45-1: enqueue for inactive port 0 [ 1559.161219][ T5889] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 1559.955145][T20509] netlink: 108 bytes leftover after parsing attributes in process `syz.6.4403'. [ 1560.680359][ T5889] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1560.842272][ T5889] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1560.842292][ T5889] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.869628][ T5889] usb 6-1: config 0 descriptor?? [ 1561.449979][T20533] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1561.450014][T20533] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1561.518632][T20533] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1561.518666][T20533] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1561.546387][T20535] syz.5.4408: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 1561.546468][T20535] CPU: 1 UID: 0 PID: 20535 Comm: syz.5.4408 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1561.546498][T20535] Tainted: [L]=SOFTLOCKUP [ 1561.546507][T20535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1561.546520][T20535] Call Trace: [ 1561.546529][T20535] [ 1561.546538][T20535] dump_stack_lvl+0xe8/0x150 [ 1561.546579][T20535] warn_alloc+0x263/0x3e0 [ 1561.546601][T20535] ? kasan_save_track+0x4f/0x80 [ 1561.546630][T20535] ? kasan_save_track+0x3e/0x80 [ 1561.546657][T20535] ? kasan_save_free_info+0x46/0x50 [ 1561.546681][T20535] ? __kasan_slab_free+0x5c/0x80 [ 1561.546709][T20535] ? tomoyo_path_number_perm+0x501/0x630 [ 1561.546738][T20535] ? security_file_ioctl+0xc3/0x2a0 [ 1561.546767][T20535] ? __se_sys_ioctl+0x47/0x170 [ 1561.546801][T20535] ? __pfx_warn_alloc+0x10/0x10 [ 1561.546841][T20535] __vmalloc_node_range_noprof+0x132/0x1750 [ 1561.546873][T20535] ? register_lock_class+0x31/0x2e0 [ 1561.546902][T20535] ? __lock_acquire+0x6b5/0x2cf0 [ 1561.546942][T20535] ? kasan_quarantine_put+0xbb/0x1f0 [ 1561.546981][T20535] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1561.547025][T20535] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1561.547045][T20535] vmalloc_noprof+0xb2/0xe0 [ 1561.547077][T20535] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1561.547100][T20535] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1561.547120][T20535] ? dvb_demux_do_ioctl+0x323/0x540 [ 1561.547155][T20535] dvb_demux_do_ioctl+0x460/0x540 [ 1561.547191][T20535] dvb_usercopy+0x199/0x2e0 [ 1561.547221][T20535] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1561.547252][T20535] ? __pfx_dvb_usercopy+0x10/0x10 [ 1561.547295][T20535] ? __fget_files+0x3a6/0x420 [ 1561.547321][T20535] ? __fget_files+0x2a/0x420 [ 1561.547347][T20535] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1561.547378][T20535] dvb_demux_ioctl+0x29/0x40 [ 1561.547410][T20535] __se_sys_ioctl+0xff/0x170 [ 1561.547440][T20535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1561.547463][T20535] do_syscall_64+0x15f/0xf80 [ 1561.547488][T20535] ? trace_irq_disable+0x3b/0x140 [ 1561.547510][T20535] ? clear_bhb_loop+0x40/0x90 [ 1561.547535][T20535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1561.547555][T20535] RIP: 0033:0x7f3d6370c819 [ 1561.547576][T20535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1561.547595][T20535] RSP: 002b:00007f3d61924028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1561.547616][T20535] RAX: ffffffffffffffda RBX: 00007f3d63986180 RCX: 00007f3d6370c819 [ 1561.547633][T20535] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000006 [ 1561.547647][T20535] RBP: 00007f3d637a2c91 R08: 0000000000000000 R09: 0000000000000000 [ 1561.547659][T20535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1561.547670][T20535] R13: 00007f3d63986218 R14: 00007f3d63986180 R15: 00007ffd2f8a7288 [ 1561.547702][T20535] [ 1561.579035][T20535] Mem-Info: [ 1561.579053][T20535] active_anon:268 inactive_anon:7992 isolated_anon:0 [ 1561.579053][T20535] active_file:26074 inactive_file:35493 isolated_file:0 [ 1561.579053][T20535] unevictable:768 dirty:213 writeback:0 [ 1561.579053][T20535] slab_reclaimable:12690 slab_unreclaimable:106884 [ 1561.579053][T20535] mapped:32639 shmem:1371 pagetables:1517 [ 1561.579053][T20535] sec_pagetables:0 bounce:0 [ 1561.579053][T20535] kernel_misc_reclaimable:0 [ 1561.579053][T20535] free:1296583 free_pcp:6926 free_cma:0 [ 1561.579645][T20535] Node 0 active_anon:1072kB inactive_anon:31968kB active_file:104092kB inactive_file:141972kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:130556kB dirty:852kB writeback:0kB shmem:3948kB kernel_stack:13764kB pagetables:5892kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1561.579703][T20535] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1561.582222][T20535] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1561.583325][T20535] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1561.583367][T20535] Node 0 DMA32 free:1232048kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1072kB inactive_anon:31968kB active_file:104092kB inactive_file:141972kB unevictable:1536kB writepending:852kB zspages:0kB present:3129332kB managed:2565008kB mlocked:0kB bounce:0kB free_pcp:27704kB local_pcp:10252kB free_cma:0kB [ 1561.584479][T20535] lowmem_reserve[]: 0 0 0 0 0 [ 1561.584531][T20535] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1561.585465][T20535] lowmem_reserve[]: 0 0 0 0 0 [ 1561.585505][T20535] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1561.822076][T20535] lowmem_reserve[]: 0 0 0 0 0 [ 1561.822123][T20535] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1562.111919][T20535] Node 0 DMA32: 3766*4kB (UM) 3234*8kB (U) 3082*16kB (UME) 938*32kB (UME) 594*64kB (UME) 616*128kB (UME) 442*256kB (UM) 274*512kB (UM) 126*1024kB (UME) 60*2048kB (UM) 120*4096kB (UM) = 1233992kB [ 1562.112048][T20535] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1562.113640][T20535] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1562.115896][T20535] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1562.115907][T20535] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1562.115919][T20535] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1562.115928][T20535] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1562.115938][T20535] 62936 total pagecache pages [ 1562.115943][T20535] 0 pages in swap cache [ 1562.115947][T20535] Free swap = 124996kB [ 1562.115952][T20535] Total swap = 124996kB [ 1562.115957][T20535] 2097051 pages RAM [ 1562.115961][T20535] 0 pages HighMem/MovableOnly [ 1562.115965][T20535] 424150 pages reserved [ 1562.115969][T20535] 0 pages cma reserved [ 1563.676146][ T5889] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1563.678051][ T5889] [drm:udl_init] *ERROR* Selecting channel failed [ 1563.697695][ T5889] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 1563.697721][ T5889] [drm] Initialized udl on minor 2 [ 1563.699242][ T5889] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1563.699701][ T5889] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1563.706865][ T5882] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1563.707539][ T5882] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1563.707746][ T5882] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1563.711295][ T5889] usb 6-1: USB disconnect, device number 34 [ 1566.741468][T20593] netlink: 108 bytes leftover after parsing attributes in process `syz.6.4435'. [ 1571.565030][T20682] fuse: Bad value for 'fd' [ 1571.919363][T20695] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4463'. [ 1571.950324][ T5882] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1571.950591][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 1572.140308][ T5882] usb 6-1: device descriptor read/64, error -32 [ 1572.380240][ T5882] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1573.253536][ T5882] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1573.253568][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1573.253589][ T5882] usb 6-1: Product: syz [ 1573.253603][ T5882] usb 6-1: Manufacturer: syz [ 1573.253618][ T5882] usb 6-1: SerialNumber: syz [ 1573.294346][ T5882] usb 6-1: config 0 descriptor?? [ 1573.396266][ T5882] hub 6-1:0.0: bad descriptor, ignoring hub [ 1573.396292][ T5882] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1573.749719][ T5882] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 1573.762859][ T5882] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1573.765822][ T5882] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 1573.765893][ T5882] usb 6-1: media controller created [ 1573.992264][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1575.544588][ T5882] DVB: Unable to find symbol dib7000p_attach() [ 1575.544607][ T5882] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 1575.691790][ T5882] rc_core: IR keymap rc-dib0700-rc5 not found [ 1575.691811][ T5882] Registered IR keymap rc-empty [ 1575.692515][ T5882] dvb-usb: could not initialize remote control. [ 1575.692527][ T5882] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 1575.914898][T14296] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 1576.062522][T14296] usb 8-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1576.062555][T14296] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.100034][T14296] usb 8-1: config 0 descriptor?? [ 1576.838810][T14296] udl 8-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1576.839233][T14296] [drm:udl_init] *ERROR* Selecting channel failed [ 1577.466162][T14296] [drm] Initialized udl 0.0.1 for 8-1:0.0 on minor 2 [ 1577.466861][T14296] [drm] Initialized udl on minor 2 [ 1577.506024][T14296] udl 8-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1577.521223][T14296] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 1577.577600][ T10] udl 8-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1577.589767][T14296] usb 8-1: USB disconnect, device number 48 [ 1577.635313][ T10] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 1579.672207][ T5882] usb 6-1: USB disconnect, device number 36 [ 1581.359161][ T5882] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 1582.860706][ T10] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1583.011200][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 1583.012962][ T10] usb 7-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 1583.013016][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1583.013041][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1583.013053][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1583.013065][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1583.014148][ T10] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1583.014176][ T10] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1583.014191][ T10] usb 7-1: Manufacturer: syz [ 1583.104199][ T10] usb 7-1: config 0 descriptor?? [ 1583.246726][T20886] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1583.246726][T20886] program syz.5.4519 not setting count and/or reply_len properly [ 1583.390332][ T10] rc_core: IR keymap rc-hauppauge not found [ 1583.390353][ T10] Registered IR keymap rc-empty [ 1583.390512][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.410305][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.433391][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 1583.453931][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input95 [ 1583.518740][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.530406][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.550377][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.572910][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.590403][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.610329][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.630345][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.646932][T20897] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4526'. [ 1583.659472][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1583.670348][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1584.067001][ T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1584.086275][ T10] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1584.086303][ T10] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1584.167188][ T5882] usb 7-1: USB disconnect, device number 29 [ 1584.306832][T20905] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1584.306832][T20905] program syz.7.4525 not setting count and/or reply_len properly [ 1585.891502][T20923] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1585.951541][T20924] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1586.681642][T20943] fuse: Bad value for 'fd' [ 1587.170245][T14296] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1587.408225][T14296] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1587.408255][T14296] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1587.408267][T14296] usb 6-1: Product: syz [ 1587.408275][T14296] usb 6-1: Manufacturer: syz [ 1587.408283][T14296] usb 6-1: SerialNumber: syz [ 1587.468847][T14296] usb 6-1: config 0 descriptor?? [ 1587.596874][T14296] hub 6-1:0.0: bad descriptor, ignoring hub [ 1587.596898][T14296] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1588.080974][T14296] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 1588.094162][T14296] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1588.100413][T14296] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 1588.100475][T14296] usb 6-1: media controller created [ 1588.156001][T14296] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1588.310679][T14296] DVB: Unable to find symbol dib7000p_attach() [ 1588.310696][T14296] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 1588.566506][T14296] rc_core: IR keymap rc-dib0700-rc5 not found [ 1588.566529][T14296] Registered IR keymap rc-empty [ 1588.566914][T14296] dvb-usb: could not initialize remote control. [ 1588.566923][T14296] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 1591.744085][T14296] usb 6-1: USB disconnect, device number 37 [ 1591.772434][ T5890] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1591.859784][T14296] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 1591.970792][ T5890] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1591.970815][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.978855][ T5890] usb 3-1: config 0 descriptor?? [ 1592.246825][T21027] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1592.246849][T21027] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1592.277650][T21027] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1592.277680][T21027] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1592.305255][T21045] syz.2.4574: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 1592.305304][T21045] CPU: 1 UID: 0 PID: 21045 Comm: syz.2.4574 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1592.305321][T21045] Tainted: [L]=SOFTLOCKUP [ 1592.305325][T21045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1592.305333][T21045] Call Trace: [ 1592.305338][T21045] [ 1592.305344][T21045] dump_stack_lvl+0xe8/0x150 [ 1592.305371][T21045] warn_alloc+0x263/0x3e0 [ 1592.305385][T21045] ? kasan_save_track+0x4f/0x80 [ 1592.305400][T21045] ? kasan_save_track+0x3e/0x80 [ 1592.305414][T21045] ? kasan_save_free_info+0x46/0x50 [ 1592.305427][T21045] ? __kasan_slab_free+0x5c/0x80 [ 1592.305443][T21045] ? tomoyo_path_number_perm+0x501/0x630 [ 1592.305460][T21045] ? security_file_ioctl+0xc3/0x2a0 [ 1592.305476][T21045] ? __se_sys_ioctl+0x47/0x170 [ 1592.305495][T21045] ? __pfx_warn_alloc+0x10/0x10 [ 1592.305520][T21045] __vmalloc_node_range_noprof+0x132/0x1750 [ 1592.305537][T21045] ? register_lock_class+0x31/0x2e0 [ 1592.305554][T21045] ? __lock_acquire+0x6b5/0x2cf0 [ 1592.305571][T21045] ? kasan_quarantine_put+0xbb/0x1f0 [ 1592.305592][T21045] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1592.305614][T21045] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1592.305629][T21045] vmalloc_noprof+0xb2/0xe0 [ 1592.305645][T21045] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1592.305658][T21045] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1592.305669][T21045] ? dvb_demux_do_ioctl+0x323/0x540 [ 1592.305688][T21045] dvb_demux_do_ioctl+0x460/0x540 [ 1592.305707][T21045] dvb_usercopy+0x199/0x2e0 [ 1592.305723][T21045] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1592.305740][T21045] ? __pfx_dvb_usercopy+0x10/0x10 [ 1592.305772][T21045] ? __fget_files+0x3a6/0x420 [ 1592.305798][T21045] ? __fget_files+0x2a/0x420 [ 1592.305827][T21045] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1592.305859][T21045] dvb_demux_ioctl+0x29/0x40 [ 1592.305889][T21045] __se_sys_ioctl+0xff/0x170 [ 1592.305920][T21045] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1592.305945][T21045] do_syscall_64+0x15f/0xf80 [ 1592.305974][T21045] ? trace_irq_disable+0x3b/0x140 [ 1592.305997][T21045] ? clear_bhb_loop+0x40/0x90 [ 1592.306025][T21045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1592.306048][T21045] RIP: 0033:0x7f6df48bc819 [ 1592.306069][T21045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1592.306088][T21045] RSP: 002b:00007f6df2af5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1592.306110][T21045] RAX: ffffffffffffffda RBX: 00007f6df4b36090 RCX: 00007f6df48bc819 [ 1592.306126][T21045] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000005 [ 1592.306140][T21045] RBP: 00007f6df4952c91 R08: 0000000000000000 R09: 0000000000000000 [ 1592.306154][T21045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1592.306167][T21045] R13: 00007f6df4b36128 R14: 00007f6df4b36090 R15: 00007ffccda5f2c8 [ 1592.306197][T21045] [ 1592.378230][T21045] Mem-Info: [ 1592.405869][T21045] active_anon:269 inactive_anon:7100 isolated_anon:0 [ 1592.405869][T21045] active_file:26086 inactive_file:35493 isolated_file:0 [ 1592.405869][T21045] unevictable:1543 dirty:117 writeback:0 [ 1592.405869][T21045] slab_reclaimable:12640 slab_unreclaimable:109611 [ 1592.405869][T21045] mapped:30925 shmem:1373 pagetables:1558 [ 1592.405869][T21045] sec_pagetables:0 bounce:0 [ 1592.405869][T21045] kernel_misc_reclaimable:0 [ 1592.405869][T21045] free:1296890 free_pcp:3510 free_cma:0 [ 1592.419996][T21045] Node 0 active_anon:1076kB inactive_anon:28400kB active_file:104140kB inactive_file:141972kB unevictable:4636kB isolated(anon):0kB isolated(file):0kB mapped:123700kB dirty:468kB writeback:0kB shmem:3956kB kernel_stack:13880kB pagetables:6056kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1592.420059][T21045] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1592.442518][T21045] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1592.449964][T21045] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 1592.450012][T21045] Node 0 DMA32 free:1233276kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1076kB inactive_anon:28400kB active_file:104140kB inactive_file:141972kB unevictable:4636kB writepending:468kB zspages:0kB present:3129332kB managed:2565008kB mlocked:3300kB bounce:0kB free_pcp:14104kB local_pcp:9264kB free_cma:0kB [ 1592.536956][T21045] lowmem_reserve[]: 0 0 0 0 0 [ 1592.537002][T21045] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:136kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1592.537326][T21045] lowmem_reserve[]: 0 0 0 0 0 [ 1592.624345][T21045] Node 1 Normal free:3938924kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1592.624413][T21045] lowmem_reserve[]: 0 0 0 0 0 [ 1592.661260][T21045] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1592.691232][T21045] Node 0 DMA32: 3963*4kB (UME) 3996*8kB (UM) 3477*16kB (UME) 736*32kB (UME) 519*64kB (UME) 598*128kB (UME) 442*256kB (UM) 277*512kB (UM) 128*1024kB (UME) 58*2048kB (UM) 120*4096kB (UM) = 1233116kB [ 1592.902624][T21045] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1592.935720][T21045] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 9*16kB (UM) 6*32kB (UM) 8*64kB (UM) 2*128kB (UM) 6*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938924kB [ 1592.935815][T21045] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1592.935825][T21045] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1592.935834][T21045] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1592.935844][T21045] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1592.935853][T21045] 62950 total pagecache pages [ 1592.935858][T21045] 0 pages in swap cache [ 1592.935862][T21045] Free swap = 124996kB [ 1592.935866][T21045] Total swap = 124996kB [ 1592.935871][T21045] 2097051 pages RAM [ 1592.935876][T21045] 0 pages HighMem/MovableOnly [ 1592.935880][T21045] 424150 pages reserved [ 1592.935889][T21045] 0 pages cma reserved [ 1593.653298][ T5890] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1593.653631][ T5890] [drm:udl_init] *ERROR* Selecting channel failed [ 1593.810515][ T5890] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 1593.810532][ T5890] [drm] Initialized udl on minor 2 [ 1593.843199][ T5890] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1593.939713][T14100] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1593.964138][ T5890] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 1594.052800][ T5890] usb 3-1: USB disconnect, device number 55 [ 1594.131702][T14100] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 1596.617138][T21103] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4609'. [ 1596.768222][T21105] sg_write: data in/out 262109/64 bytes for SCSI command 0x69-- guessing data in; [ 1596.768222][T21105] program syz.6.4608 not setting count and/or reply_len properly [ 1596.937202][T17650] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1596.997214][T17650] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1596.998671][T17650] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1597.023541][T17650] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1597.046857][T17650] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1597.566444][T21119] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4612'. [ 1597.566468][T21119] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4612'. [ 1597.777521][T21123] fuse: Bad value for 'fd' [ 1598.468540][ T5882] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1598.857891][ T5882] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1598.857912][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1598.857924][ T5882] usb 3-1: Product: syz [ 1598.857932][ T5882] usb 3-1: Manufacturer: syz [ 1598.857940][ T5882] usb 3-1: SerialNumber: syz [ 1598.909074][ T5882] usb 3-1: config 0 descriptor?? [ 1598.913146][ T5882] hub 3-1:0.0: bad descriptor, ignoring hub [ 1598.913175][ T5882] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1599.130361][ T5818] Bluetooth: hci5: command tx timeout [ 1599.255703][ T5882] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1599.385158][ T5882] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1599.385204][ T5882] dib0700: firmware download failed at 7 with -22 [ 1599.734117][T21106] chnl_net:caif_netlink_parms(): no params data found [ 1600.070738][T21106] bridge0: port 1(bridge_slave_0) entered blocking state [ 1600.070933][T21106] bridge0: port 1(bridge_slave_0) entered disabled state [ 1600.071110][T21106] bridge_slave_0: entered allmulticast mode [ 1600.106056][T21106] bridge_slave_0: entered promiscuous mode [ 1600.186211][T21106] bridge0: port 2(bridge_slave_1) entered blocking state [ 1600.186330][T21106] bridge0: port 2(bridge_slave_1) entered disabled state [ 1600.186654][T21106] bridge_slave_1: entered allmulticast mode [ 1600.190032][T21106] bridge_slave_1: entered promiscuous mode [ 1600.563691][T21138] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 1600.563721][T21138] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1600.619004][T21138] vhci_hcd vhci_hcd.0: Device attached [ 1600.850273][T14296] usb 45-1: new low-speed USB device number 6 using vhci_hcd [ 1600.917050][T21139] vhci_hcd: connection reset by peer [ 1600.919346][ T4278] vhci_hcd vhci_hcd.6: stop threads [ 1600.919367][ T4278] vhci_hcd vhci_hcd.6: release socket [ 1600.919409][ T4278] vhci_hcd vhci_hcd.6: disconnect device [ 1601.210202][ T5818] Bluetooth: hci5: command tx timeout [ 1602.012327][T21155] netlink: 108 bytes leftover after parsing attributes in process `syz.6.4619'. [ 1602.219955][ T3599] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1602.521413][ T5889] usb 3-1: USB disconnect, device number 56 [ 1602.579073][T21106] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1602.613036][T21149] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4618'. [ 1602.622967][T21106] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1602.845976][T21106] team0: Port device team_slave_0 added [ 1602.857084][T21106] team0: Port device team_slave_1 added [ 1602.942391][T21106] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1602.942410][T21106] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1602.942437][T21106] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1602.944751][T21106] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1602.944768][T21106] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1602.944793][T21106] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1603.150367][T14807] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 1603.328414][ T5818] Bluetooth: hci5: command tx timeout [ 1603.329123][T14807] usb 8-1: Using ep0 maxpacket: 16 [ 1603.334259][T14807] usb 8-1: config 0 has an invalid descriptor of length 37, skipping remainder of the config [ 1603.334311][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1603.334338][T14807] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1603.334360][T14807] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1603.334383][T14807] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1603.335453][T14807] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1603.335479][T14807] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1603.335497][T14807] usb 8-1: Manufacturer: syz [ 1603.361355][T14807] usb 8-1: config 0 descriptor?? [ 1603.660236][T14807] rc_core: IR keymap rc-hauppauge not found [ 1603.660259][T14807] Registered IR keymap rc-empty [ 1603.660421][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.667194][ T3599] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1603.680530][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.702483][T14807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1603.706595][T14807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input97 [ 1603.717616][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.730504][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.750575][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.771361][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.790779][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.811281][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.833245][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.851139][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.870412][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.890330][T14807] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 1603.918774][T14807] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1603.918801][T14807] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1604.038081][T21106] hsr_slave_0: entered promiscuous mode [ 1604.047556][T21106] hsr_slave_1: entered promiscuous mode [ 1604.057545][T21106] debugfs: 'hsr0' already exists in 'hsr' [ 1604.057572][T21106] Cannot create hsr debugfs directory [ 1604.064188][T15235] usb 8-1: USB disconnect, device number 49 [ 1604.655095][ T3599] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1606.152633][ T5818] Bluetooth: hci5: command tx timeout [ 1606.241104][T14296] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 1606.241589][ T10] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 1606.284950][ T3599] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1606.422412][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 1606.424572][ T10] usb 8-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 1606.424602][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1606.462170][ T10] usb 8-1: config 0 descriptor?? [ 1606.495349][ T10] gspca_main: sunplus-2.14.0 probing 041e:400b [ 1607.389699][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.389861][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.414178][ T10] gspca_sunplus: reg_r err -110 [ 1607.414248][ T10] sunplus 8-1:0.0: probe with driver sunplus failed with error -110 [ 1608.909564][T21208] fuse: Bad value for 'fd' [ 1609.128800][T21216] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4635'. [ 1609.450320][ T5882] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1609.714123][ T5882] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1609.714144][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1609.714155][ T5882] usb 6-1: Product: syz [ 1609.714163][ T5882] usb 6-1: Manufacturer: syz [ 1609.714171][ T5882] usb 6-1: SerialNumber: syz [ 1609.861869][ T5882] usb 6-1: config 0 descriptor?? [ 1609.908383][ T5882] hub 6-1:0.0: bad descriptor, ignoring hub [ 1609.908407][ T5882] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1610.375546][ T5882] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 1610.463857][ T5882] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1610.466113][ T5882] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 1610.466147][ T5882] usb 6-1: media controller created [ 1610.560562][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1610.969405][ T5882] DVB: Unable to find symbol dib7000p_attach() [ 1610.969415][ T5882] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 1611.203494][ T5882] rc_core: IR keymap rc-dib0700-rc5 not found [ 1611.203516][ T5882] Registered IR keymap rc-empty [ 1611.203797][ T5882] dvb-usb: could not initialize remote control. [ 1611.203808][ T5882] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 1611.443170][ T5882] usb 8-1: USB disconnect, device number 50 [ 1613.510265][ T5889] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1613.520940][ T3599] bridge_slave_1: left allmulticast mode [ 1613.520968][ T3599] bridge_slave_1: left promiscuous mode [ 1613.521230][ T3599] bridge0: port 2(bridge_slave_1) entered disabled state [ 1613.585250][ T3599] bridge_slave_0: left allmulticast mode [ 1613.585279][ T3599] bridge_slave_0: left promiscuous mode [ 1613.585536][ T3599] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.655015][ T5882] usb 6-1: USB disconnect, device number 38 [ 1613.678055][ T5889] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1613.678091][ T5889] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1613.678117][ T5889] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1613.678139][ T5889] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1613.678181][ T5889] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1613.678205][ T5889] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1613.735430][ T5889] usb 3-1: config 0 descriptor?? [ 1613.964788][T21254] ================================================================== [ 1613.964807][T21254] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 [ 1613.964926][T21254] Read of size 1 at addr ffff8880689ce868 by task syz.5.4643/21254 [ 1613.964943][T21254] [ 1613.964959][T21254] CPU: 1 UID: 0 PID: 21254 Comm: syz.5.4643 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1613.964990][T21254] Tainted: [L]=SOFTLOCKUP [ 1613.964998][T21254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1613.965011][T21254] Call Trace: [ 1613.965020][T21254] [ 1613.965029][T21254] dump_stack_lvl+0xe8/0x150 [ 1613.965062][T21254] print_address_description+0x55/0x1e0 [ 1613.965107][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.965129][T21254] print_report+0x58/0x70 [ 1613.965156][T21254] kasan_report+0x117/0x150 [ 1613.965190][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.965218][T21254] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.965238][T21254] __kasan_check_byte+0x2a/0x40 [ 1613.965269][T21254] lock_acquire+0x84/0x350 [ 1613.965293][T21254] ? rt_spin_lock+0x1e0/0x400 [ 1613.965313][T21254] ? rcu_is_watching+0x15/0xb0 [ 1613.965415][T21254] _raw_spin_lock_irqsave+0x40/0x60 [ 1613.965440][T21254] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.965461][T21254] rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.965480][T21254] ? reacquire_held_locks+0x104/0x190 [ 1613.965504][T21254] ? rt_spin_lock+0x1e0/0x400 [ 1613.965524][T21254] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1613.965545][T21254] ? rt_spin_unlock+0x14f/0x200 [ 1613.965564][T21254] ? rt_spin_unlock+0x160/0x200 [ 1613.965584][T21254] dma_buf_fd+0x178/0x330 [ 1613.965667][T21254] dma_heap_ioctl+0x50b/0x620 [ 1613.965724][T21254] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 1613.965759][T21254] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1613.965823][T21254] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 1613.965850][T21254] __se_sys_ioctl+0xff/0x170 [ 1613.965882][T21254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.965904][T21254] do_syscall_64+0x15f/0xf80 [ 1613.965930][T21254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.965951][T21254] ? clear_bhb_loop+0x40/0x90 [ 1613.965974][T21254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.965995][T21254] RIP: 0033:0x7f3d6370c819 [ 1613.966014][T21254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1613.966033][T21254] RSP: 002b:00007f3d61966028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1613.966057][T21254] RAX: ffffffffffffffda RBX: 00007f3d63985fa0 RCX: 00007f3d6370c819 [ 1613.966072][T21254] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000006 [ 1613.966087][T21254] RBP: 00007f3d637a2c91 R08: 0000000000000000 R09: 0000000000000000 [ 1613.966100][T21254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1613.966113][T21254] R13: 00007f3d63986038 R14: 00007f3d63985fa0 R15: 00007ffd2f8a7288 [ 1613.966136][T21254] [ 1613.966145][T21254] [ 1613.966158][T21254] Allocated by task 21254: [ 1613.966169][T21254] kasan_save_track+0x3e/0x80 [ 1613.966196][T21254] __kasan_kmalloc+0x93/0xb0 [ 1613.966224][T21254] __kmalloc_noprof+0x3e7/0x7b0 [ 1613.966315][T21254] dma_buf_export+0x3ba/0xad0 [ 1613.966340][T21254] system_heap_allocate+0xf11/0x1430 [ 1613.966376][T21254] dma_heap_ioctl+0x4ce/0x620 [ 1613.966402][T21254] __se_sys_ioctl+0xff/0x170 [ 1613.966431][T21254] do_syscall_64+0x15f/0xf80 [ 1613.966455][T21254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.966475][T21254] [ 1613.966479][T21254] Freed by task 21255: [ 1613.966490][T21254] kasan_save_track+0x3e/0x80 [ 1613.966515][T21254] kasan_save_free_info+0x46/0x50 [ 1613.966537][T21254] __kasan_slab_free+0x5c/0x80 [ 1613.966564][T21254] kfree+0x1c5/0x6c0 [ 1613.966596][T21254] __dentry_kill+0x211/0x5e0 [ 1613.966615][T21254] finish_dput+0xc9/0x480 [ 1613.966638][T21254] __fput+0x6a3/0xa70 [ 1613.966701][T21254] task_work_run+0x1d9/0x270 [ 1613.966795][T21254] exit_to_user_mode_loop+0xed/0x480 [ 1613.966846][T21254] do_syscall_64+0x33e/0xf80 [ 1613.966870][T21254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.966890][T21254] [ 1613.966896][T21254] The buggy address belongs to the object at ffff8880689ce800 [ 1613.966896][T21254] which belongs to the cache kmalloc-1k of size 1024 [ 1613.966914][T21254] The buggy address is located 104 bytes inside of [ 1613.966914][T21254] freed 1024-byte region [ffff8880689ce800, ffff8880689cec00) [ 1613.966936][T21254] [ 1613.966942][T21254] The buggy address belongs to the physical page: [ 1613.966953][T21254] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x689c8 [ 1613.966972][T21254] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1613.966989][T21254] flags: 0x80000000000040(head|node=0|zone=1) [ 1613.967006][T21254] page_type: f5(slab) [ 1613.967025][T21254] raw: 0080000000000040 ffff88801a01fdc0 dead000000000100 dead000000000122 [ 1613.967043][T21254] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1613.967062][T21254] head: 0080000000000040 ffff88801a01fdc0 dead000000000100 dead000000000122 [ 1613.967080][T21254] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1613.967099][T21254] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1613.967116][T21254] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 1613.967126][T21254] page dumped because: kasan: bad access detected [ 1613.967142][T21254] page_owner tracks the page as allocated [ 1613.967151][T21254] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/u8:3), ts 97547451750, free_ts 0 [ 1613.967185][T21254] post_alloc_hook+0x231/0x280 [ 1613.967216][T21254] get_page_from_freelist+0x27c8/0x2840 [ 1613.967236][T21254] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1613.967256][T21254] allocate_slab+0x77/0x660 [ 1613.967277][T21254] refill_objects+0x33c/0x3d0 [ 1613.967297][T21254] __pcs_replace_empty_main+0x373/0x720 [ 1613.967319][T21254] __kmalloc_noprof+0x530/0x7b0 [ 1613.967343][T21254] ieee802_11_parse_elems_full+0x159/0x2ab0 [ 1613.967453][T21254] ieee80211_inform_bss+0x161/0x1160 [ 1613.967548][T21254] cfg80211_inform_single_bss_data+0xd2f/0x1b80 [ 1613.967633][T21254] cfg80211_inform_bss_data+0x266/0x3c40 [ 1613.967663][T21254] cfg80211_inform_bss_frame_data+0x3c7/0x730 [ 1613.967691][T21254] ieee80211_bss_info_update+0x794/0xa40 [ 1613.967715][T21254] ieee80211_ibss_rx_queued_mgmt+0x1901/0x2cb0 [ 1613.967765][T21254] ieee80211_iface_work+0x845/0x1390 [ 1613.967793][T21254] cfg80211_wiphy_work+0x2cf/0x460 [ 1613.967840][T21254] page_owner free stack trace missing [ 1613.967848][T21254] [ 1613.967853][T21254] Memory state around the buggy address: [ 1613.967865][T21254] ffff8880689ce700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1613.967879][T21254] ffff8880689ce780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1613.967892][T21254] >ffff8880689ce800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1613.967902][T21254] ^ [ 1613.967914][T21254] ffff8880689ce880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1613.967928][T21254] ffff8880689ce900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1613.967938][T21254] ================================================================== [ 1613.967957][T21254] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1613.967978][T21254] CPU: 1 UID: 0 PID: 21254 Comm: syz.5.4643 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1613.968006][T21254] Tainted: [L]=SOFTLOCKUP [ 1613.968015][T21254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1613.968028][T21254] Call Trace: [ 1613.968037][T21254] [ 1613.968046][T21254] vpanic+0x56c/0xa60 [ 1613.968068][T21254] ? __pfx_vpanic+0x10/0x10 [ 1613.968089][T21254] panic+0xc5/0xd0 [ 1613.968107][T21254] ? __pfx_panic+0x10/0x10 [ 1613.968124][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968147][T21254] ? rcu_is_watching+0x15/0xb0 [ 1613.968173][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968195][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968214][T21254] check_panic_on_warn+0x89/0xb0 [ 1613.968288][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968307][T21254] end_report+0x73/0x170 [ 1613.968334][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968365][T21254] kasan_report+0x128/0x150 [ 1613.968393][T21254] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968417][T21254] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.968437][T21254] __kasan_check_byte+0x2a/0x40 [ 1613.968463][T21254] lock_acquire+0x84/0x350 [ 1613.968487][T21254] ? rt_spin_lock+0x1e0/0x400 [ 1613.968504][T21254] ? rcu_is_watching+0x15/0xb0 [ 1613.968530][T21254] _raw_spin_lock_irqsave+0x40/0x60 [ 1613.968554][T21254] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.968575][T21254] rt_mutex_slowunlock+0xbf/0x8b0 [ 1613.968594][T21254] ? reacquire_held_locks+0x104/0x190 [ 1613.968621][T21254] ? rt_spin_lock+0x1e0/0x400 [ 1613.968642][T21254] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1613.968663][T21254] ? rt_spin_unlock+0x14f/0x200 [ 1613.968684][T21254] ? rt_spin_unlock+0x160/0x200 [ 1613.968704][T21254] dma_buf_fd+0x178/0x330 [ 1613.968732][T21254] dma_heap_ioctl+0x50b/0x620 [ 1613.968764][T21254] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 1613.968799][T21254] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1613.968818][T21254] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 1613.968858][T21254] __se_sys_ioctl+0xff/0x170 [ 1613.968890][T21254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.968913][T21254] do_syscall_64+0x15f/0xf80 [ 1613.968937][T21254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.968958][T21254] ? clear_bhb_loop+0x40/0x90 [ 1613.968982][T21254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.969002][T21254] RIP: 0033:0x7f3d6370c819 [ 1613.969020][T21254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1613.969039][T21254] RSP: 002b:00007f3d61966028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1613.969061][T21254] RAX: ffffffffffffffda RBX: 00007f3d63985fa0 RCX: 00007f3d6370c819 [ 1613.969078][T21254] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000006 [ 1613.969094][T21254] RBP: 00007f3d637a2c91 R08: 0000000000000000 R09: 0000000000000000 [ 1613.969107][T21254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1613.969121][T21254] R13: 00007f3d63986038 R14: 00007f3d63985fa0 R15: 00007ffd2f8a7288 [ 1613.969145][T21254] [ 1613.969852][T21254] Kernel Offset: disabled