last executing test programs: 5m40.580575112s ago: executing program 4 (id=770): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x1c, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x20}}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80005}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x160fb5a9f24a6945}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 5m40.309247232s ago: executing program 4 (id=771): r0 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r4, 0xbde7c000) (async) ioctl$KVM_HYPERV_EVENTFD(r3, 0x400caed0, 0x0) (async, rerun: 64) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="0bcfcc8b8f9e41dc2f59741c32dbbd98de411e97aa2a306f1fb091e7e8994029d76ccf27f73ec6fdda0475062dcdfc62858ee49dbed0fc7986da5df5ce69096275e3a0e5346985d7178021807642b01d2b5d5b3e9ed8794182b0792e1e2618b9a4fcd955d46ece7ce99cc7326dbeb249090d8d2b45759a56ce35", 0x7a}], 0x1, 0x0, 0x5c}, 0x1) (async, rerun: 64) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="500000001000010026bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0c57040000000000140003006e657464657673696d3000000000000014001680"], 0x50}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) (async, rerun: 32) r5 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 32) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$pppl2tp(0x18, 0x1, 0x1) (async) r7 = socket$inet_udp(0x2, 0x2, 0x0) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, r7, 0x44, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x32) (async) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000380)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x4, 0x4}}, 0x26) (async) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="0000cd28344b6b422bb95598f06196e0f8f53baa3c592f4b8ab2d25efda35a00c94416a63021ef38cd7a20e0a178b8ee3a2f208ff3c73a73c3e96c94ebe536d1943ea7d5e818d8c6ce78da7dcf082ffb4e7274a977a1fa59acd003c74fd38c7b67a801c2282e53d8cdb6361eb5a0ca9064581b75a992c0", @ANYRES16=r6, @ANYBLOB="01002cbd7010fcdbdf2505000000080009000200000008000c00a80a000008000b000000000006000100070000000c0016000004000000000000050014001b000000"], 0x48}}, 0x20) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000078000100ffff0000fdc9df250700000043"], 0x18}, 0x1, 0x5502000000000000}, 0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r13, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r10, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0x6, r11, 0x0, 0x0, 0x1}]) (async) r14 = open(&(0x7f0000000200)='./bus\x00', 0x14507e, 0x0) fallocate(r14, 0x21, 0x5, 0x1000f8) (async, rerun: 64) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) (rerun: 64) r15 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x221c0, 0xac) (async, rerun: 32) r16 = fanotify_init(0x200, 0x0) (rerun: 32) fanotify_mark(r16, 0x201, 0x800003f, r15, 0x0) 5m39.914763995s ago: executing program 4 (id=773): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000180)={0xa, &(0x7f0000000080)=[{0x3, 0x7f, 0x8c, 0xfff}, {0x4, 0x2, 0x5, 0x5}, {0x1, 0x2, 0xfe, 0x2d}, {0x6, 0x0, 0x2, 0x1}, {0x9, 0x9, 0x9}, {0x35a, 0xfa, 0xc, 0x78760160}, {0xa4, 0xc, 0x7, 0x9}, {0x7104, 0xfd, 0x2, 0x6}, {0x7, 0x6, 0x4, 0x4}, {0x9, 0x6, 0x19, 0x2}]}) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000040)="6b1690bb8dc095ebae95baccdce177a97389ae7df65487e3996df64c35efa6e159bd2f2180", 0xfdef}], 0x1, &(0x7f0000000600)=ANY=[@ANYBLOB="040000000000000000000000ed2300001a4c8c9f69a37a163eec537bea1e04acba252ae91e8e4c0e7d46ddb49419f3dddba273d15af89b1b08b151ecbd3ffc41aa5e46d9e8453ccb594ef5591a35a2909a8cd6973a7b15e9896484805beffba18fa8cfba7efcaa9f3787c6aa00e6b63a904ca91886a17280a752c7699ad1f006cd9ba77ba2d8be5e834f49c8d47c166de232e366b71545637a1873bf915be05410f1f1ae526cf5261120f89e5388", @ANYRES32=0x0, @ANYBLOB="ac1414aaac14140000000000160000000000000000000000070000009404000000020000"], 0x38}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x24, 0x0, 0x1, 0x0, 0x1000000, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, "d6"}]}, 0x24}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r13, 0x0, r15, 0x0, 0x1, 0x0) vmsplice(r15, &(0x7f0000000400)=[{&(0x7f0000000840)="042a346f234276951da823c4934899ba2c4b8c16f25f228028a7a21c064dce490ebb1e6d1466e440a9a03e4b96e22443dfe863a1dfb1f04046eb8d31a1ff9aacbd3183b5e505b0f5adba040cdc84d9bb9d09f89ddf7833f7882ca983e50f23d11540f64d620351e3b913c7faff54051834f45d57a74f9f", 0xfffffcc2}], 0x1, 0x6) read$FUSE(r14, &(0x7f0000000dc0)={0x2020}, 0x2020) ioctl$sock_inet_udp_SIOCINQ(r15, 0x541b, 0x0) write(r12, 0x0, 0x0) r16 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r16, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="df947aef0000000000003a00000008000300", @ANYRES32=r11, @ANYBLOB="05005b0016000000"], 0x24}}, 0x0) r17 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r18 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r0) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xb8, r18, 0x8, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6b9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf58}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x46c}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4000044}, 0x8800) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r17, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) 5m39.112184274s ago: executing program 4 (id=777): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000340)={0x8, 0x8003, 0x2, 0x5, r7}, &(0x7f00000001c0)=0x10) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r10 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="0667726f75785f000000000000000614d885e8f4060bebf52c3a17689a61b2aa149e4db697a6d76e0eff8e0b40cffd05f22674bb43e13681c01cb27bc50d26232c3791", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', r10, &(0x7f0000000180)='./file0\x00', 0x112) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000078000000030a01030000000000000000050000000900010073797a300000000008000540000000001c0008800c000240000000000000ffff0b00014000000000000000000900030073797a3200000000280004800800024000000000140003007465616d5f736c6176655f3000000000080001"], 0xd4}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0xe, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x6, @dev={0xac, 0x14, 0x14, 0x18}, 0x4e24, 0x4, 'sh\x00', 0x31ada05a8091b55a, 0x0, 0x5f}, 0x2c) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000000000), 0x4) 5m38.093274817s ago: executing program 4 (id=783): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) semget$private(0x0, 0x4000000009, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = syz_io_uring_setup(0x5424, &(0x7f00000002c0)={0x0, 0x4533, 0x10100, 0x0, 0x80002b1}, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000000203010300000000000000000200000608000440000000150800054000000007080001000100001d08000340000000050377c9a6ba62224d936f75e06ed31453df00a594102fa0c83931691a360d5405b325126be9eee98fefc5683fd5e884d27cf882d90258dcac8b1fe975428f24f7bab50200374d8c08a968fb42535334cb8747565270fd4fdbd46b57c67eb345ca2d8ba963ff1bec0bb61b7cc074841738bc4100ebafad630352b858e604e52a06078b9b055d7e1d9c3f29a47ec2bac2804596f814367b5bad2b2f109be78e64d40801949c9e2839ff83191f51e1411c25c814f79d5a09b9f6d5577ebf17f862093b1b031fda344997b5"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x201}, 0x1}) clock_getres(0x0, 0x0) io_uring_enter(r4, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) writev(r8, &(0x7f0000001480)=[{&(0x7f0000001100)="c806f6", 0x3}, {0x0}], 0x2) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r10 = accept4(r9, 0x0, 0x0, 0x0) pipe(&(0x7f0000001240)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r11, r10, 0x0, 0x24) r12 = semget(0x2, 0x1, 0x204) semtimedop(r12, &(0x7f0000000040)=[{0x0, 0x0, 0x1000}, {0x2, 0x40, 0x1c00}], 0x2, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r1, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0xd6, 0x1c, 0x7, 0xfe, 0x401, 0x7, 0xa, 0x0, 0x52, 0x8000, 0x7e9, 0x401, 0x5, "cb630dab3a0338057401a192419598961f50dc45c87d55b42a28b8f01c0e0e7a"}}) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 5m37.221620237s ago: executing program 4 (id=786): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(0xffffffffffffffff, 0xc0c85666, &(0x7f0000000200)={{0x1, @addr=0x9}, "8f7eb5112f898f635de9626c9f2a4a0e8623b743095107729eae0b6d635827e0", 0x3}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 5m36.157713453s ago: executing program 32 (id=786): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(0xffffffffffffffff, 0xc0c85666, &(0x7f0000000200)={{0x1, @addr=0x9}, "8f7eb5112f898f635de9626c9f2a4a0e8623b743095107729eae0b6d635827e0", 0x3}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 11.742543601s ago: executing program 0 (id=1932): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) shutdown(r1, 0x1) eventfd(0xffff) socket$igmp6(0xa, 0x3, 0x2) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0x8000000000000000, 0x8000f, 0x7fff, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x9, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) 10.84568771s ago: executing program 0 (id=1935): socket$inet6(0xa, 0x801, 0x5) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000100)={0x1, "fa02c8098000"}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=@newsa={0x154, 0x10, 0x713, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x4e23, 0x4000}, {@in=@multicast2, 0x4d3, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @empty}, {0x0, 0x2, 0x400000000000}, {0x100000000000000}, {}, 0xfffffffc, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e22, 0x4e24, @in=@empty}}]}, 0x154}, 0x1, 0x0, 0x0, 0x88d0}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000140)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, [0x0], [0x0, 0x0, 0xf], [0x1000], [0x0, 0x0, 0x0, 0xffffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000100)={r7, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c642d, &(0x7f00000001c0)={r9, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000200)={0x0, 0x0, r10}) 8.388205373s ago: executing program 1 (id=1939): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x258403) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x5319) 8.202044865s ago: executing program 1 (id=1941): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r0, &(0x7f0000002280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) sendmsg$inet6(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000280)="03a0f754dbae8f37f02ee53643de3992553aa66f3979a0f64641f2d6b563073b8b886705b369a4a648a152a1545858631dad337ac64f735e7e174affaa0141b664002ef4ee10d31d2afff2ef42c2a56bc78e10c0b7a90c95cfbdc7a5503c088e05e7aaa3ef4fc2cff74c02aab34e0bab69dce1a44d83d3b83ea98b24ed085a83e613edce4f7b5ad926596bf46cd7ac93aa5eb09330b112bd426dbc6d60fa7906b23fd0b853af6c55427d35ccdd78dd6be011094cd400a0ce55b575a9681128908e4b8e9bbab0bc734255b2419b88c1542a171e62f3fcc9c961f31d16c8997ff0d7d5886276f24ed1f5878b1ada5df013be0e0fab4b486e5e581c5fc94a6665c4285b43806f65c6966c03cb29475dcc2db19dc383535863574b95e97abafd86eb66610bb2d9274d26ee4e93372ed6c1", 0x12f}], 0x1}, 0x20000044) 8.127080776s ago: executing program 5 (id=1942): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e0000002000000000000000000000000ac1e010100000000000000000000000000000000000000000a00200000000000", @ANYRES32=0x0, @ANYRES32=0x0], 0xb8}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv4_delrule={0x2c, 0x18, 0x1, 0x0, 0x0, {0xa, 0x2}, [@FRA_DST={0x8, 0x1, @broadcast}, @FRA_SRC={0x8, 0x2, @remote}]}, 0x2c}}, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0x99, 0x0, 0x0, 0x10000, 0x2, '\x00', 0xc94}) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000000c0)={0x28, r1, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x16}]}]}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x800) 8.067130489s ago: executing program 1 (id=1943): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0xc2a) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000) 7.571760362s ago: executing program 0 (id=1944): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000080], 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000084000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000200000000000000000000000000000000000000000001000000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000"]}, 0x108) 7.430045466s ago: executing program 5 (id=1945): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) shutdown(r1, 0x1) eventfd(0xffff) socket$igmp6(0xa, 0x3, 0x2) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0x8000000000000000, 0x8000f, 0x7fff, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x9, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) 7.376797832s ago: executing program 0 (id=1946): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/notes', 0x80c00, 0x8) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20008000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xe0a42, 0x0) syslog(0x1, &(0x7f0000000280)=""/184, 0xb8) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r4 = syz_usb_connect(0x5, 0x36, &(0x7f0000000400)=ANY=[], 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="5800e4ff", @ANYRESHEX=r4, @ANYBLOB="010029bd7000000000000200000008000300", @ANYRES32=r3, @ANYRES32=0x0], 0x58}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000700)=ANY=[@ANYRESHEX, @ANYRESOCT=r0, @ANYRES64, @ANYRESHEX, @ANYRESOCT, @ANYRES16=r0], 0x24}, 0x1, 0x0, 0x0, 0x24040041}, 0x11420cdda14a5db9) r6 = syz_open_dev$loop(0x0, 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, 0x0) userfaultfd(0x80001) r7 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x0, 0x40000133}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000380)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4a, 0x2004, @fd_index=0x7, 0x5e, 0x0, 0x0, 0x10, 0x0, {0x1}}) io_uring_enter(r7, 0x847ba, 0x0, 0xe, 0x0, 0x0) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x80}]}, 0x10) r11 = socket$inet6(0xa, 0x80002, 0x1) setsockopt$inet6_udp_int(r11, 0x11, 0xa, &(0x7f0000000080)=0x6, 0x4) ioctl$sock_inet6_udp_SIOCINQ(r11, 0x541b, &(0x7f0000000400)) sendmmsg$inet(r11, &(0x7f00000001c0)=[{{&(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10, 0x0, 0x22}}], 0x1, 0x0) r12 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) bind$inet6(r10, &(0x7f0000000140)={0xa, 0x4e1f, 0x0, @loopback, 0x5}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000440)={'wlan1\x00'}) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r5, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x6, 0x48}}}}, [@NL80211_ATTR_MAC={0xa}]}, 0x34}}, 0x4000) sendto$inet6(r10, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 7.33066859s ago: executing program 5 (id=1947): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$kcm(0xa, 0x6, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x10d, 0xa, &(0x7f0000000000)=r2, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r5 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r3, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r5, 0x2ded, 0x4000, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000080)={0x1d, r10, 0x2, {0x1, 0x0, 0x5}}, 0x18) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), r9) r11 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x16b601, 0x0) write$sequencer(r11, &(0x7f0000000240)=ANY=[@ANYBLOB="0293"], 0x9) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom0\x00', 0x802, 0x0) r13 = socket(0x18, 0x4, 0x9) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000500)={0x64, 0x0, &(0x7f0000000440)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)={@fd={0x66642a85, 0x0, r13}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/107, 0x6b, 0x1, 0x21}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/164, 0xa4, 0x2, 0x20}}, &(0x7f0000000200)={0x0, 0x18, 0x40}}}, @request_death, @request_death], 0x29, 0x0, &(0x7f00000004c0)="4ea810b30d0a1a3893353051e864cbd714e75aca0d259e73245e0cbac542cd03429fa9b6b14e1a326f"}) ioctl$SNDCTL_SEQ_SYNC(r11, 0x5101) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x3c1, 0x3, 0x3c0, 0x188, 0x4c, 0x1a, 0x0, 0x73, 0x2f0, 0x258, 0x258, 0x2f0, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @mcast2, [], [], 'wg2\x00', 'macvlan1\x00'}, 0x0, 0x128, 0x188, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz1\x00'}}, @common=@unspec=@statistic={{0x38}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@mcast2, [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@srh={{0x30}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf3893b573a807d00}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x420) 6.042887009s ago: executing program 5 (id=1951): socket$nl_netfilter(0x10, 0x3, 0xc) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xe0a42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 4.34025024s ago: executing program 5 (id=1956): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x22100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000200), 0x200900, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20040800) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) read$FUSE(r2, 0x0, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x12, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x4202, 0x184, 0x2}, 0x18) r3 = socket$unix(0x1, 0x1, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000600)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {}, {0x3, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_ife={0x50, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x4, 0xed, 0x100004}, 0x1}}, @TCA_IFE_METALST={0x8, 0x6, [@IFE_META_TCINDEX={0x4, 0x5, @void}]}]}, {0x2}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000240)=ANY=[@ANYBLOB="640000001200030528bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800b0001006272696467650000340002800c00230006000000000000000c00210003000000000000000500250001000000050017000100000008000400030000"], 0x64}}, 0x0) sendto$inet(0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x10, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r7 = memfd_create(&(0x7f0000000200)='[\v\xdb\xb3\x94\x00\x00\x00\x00\x00\x00\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6\xe1\x9f\xe8\xf1\xb3\b\xe2q\xda\xd8\xb1\x82\x1eb;(\xb5\xe1nS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc6\xd7\x89\xf8a\xc3\xcf\xd3\xae\x80G\"\xbc(\x95\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\xc1\f\xd0\x99E\xd7\xab\x86\x04\xd3\xb0\xa7V\x97^8T&\xd1o9\xe7\x02\xc7\f\xdd\xa8T\xa2,\x1b\xf3j\xa3\xb0\xa4\xd5r\x0e=\x992w\x7fa\xbdR\x9aT\x9d\x04:\xb8\xe3\xe4\xe5\x8e;9\x97\xf3|\xfe\x81\xd1\t\a\x8e\x99\xbe\x06?\x89\xc0D\xaa\xdeT\x1d\xf0PA\xf8\xad\xf4\xfb_\xf0\x10\xd8\xcb\xaf\x0eb5\xc3\x89\x17r\x00\x00\xc8\x00\x02f\x03\x1b\x15\x1d\x02\x94/\xcc\xd5\xbfNI\xc1\x9c\xa7X\x01|\x8e:\x83O\xc46\xb3s\xeb\xfb\x9d\x83\xdf\xec\xbfS\xa6\xd8\x03\x95\x9e\xf5\xba\x01W\xd7V\xa1\xf6D\xf8\xd1\xcf\xe8\b\x94l\x00\x00\x00\x00\x00\x00\x00\x00\x7f\'r\x17\xa1\xfe{\xe2\x8cd\x03\t\x10O\xdf\xcf\xc6\xc1\x94;\x84\xfe\x88\xdf\xe5\x83\xc7T@\xb1t\xf5\xeb\xbc\xe5}\x80\x9f\xe2\x15\xe8\x8fy\xfc\x0f\xb1\xc5\x1a\xa2\xdb\x99\x11`\xf0\xf2W/\xc2\xb5\x94\x11\x84\x98\xb1V\xb0l;\x8a_\xf4\x16([f/\xd4J\xd3\x03\xb3t\t*K\x83\xa0\x832\xea\xe6\f\x89\x15~{d\xd9\xc8\xebh\xcc\x82\f\xcc}\xb0\x03Q\x8f\xff&cS\x9f\xbb\xb6\xc8\xc2@#\xc0m\x83\x93a\xbd!\xcfO\xa9\xf05\x9f\xc1T\xac\x84q\x8f\xd8\x90[p\x15l%\xfb\xf1\x96ui_\x018+#\x1f\xd6\xb6\xf1\xed\xbb_\xec\x1b\x9bN\x04\xd1f\xa5\xb9m\x19_v\xb9\x0e\xbdP\x8d\x8c\x1c{\xd8\x90\x8f\xef\xea\r\xdb\xb1\xder\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8e\x8cX\x82:\xf8{\xed\xdajiF\x15\xa5u \xe7\xf9o\xc2 t\vM\xa8\x80z\xf7\b\xcb\\:\xd8C\xf8/\xcc\x1f\xa7\x02\x9e-\x83?R1@0\xb4\xfb;]\x9d\x01\"{\xd9\x9b\x12Pk^\x9fy\xba~\r\xbe\x1a\xa7\xa7k\xa8\xf4s>\xfcr\xa2,\xa9d\xbf\xb2\x97\xe1\x85\x88\x1a4\xe56\xaf=\x89\xe6\x13\xf0\xf5\xd7\f\xa1\b\xed=\x12-}N\xca%\x11\x0e\xb3\xba\xb2T\x9a.\xf4\xb2\xaej\xfaM\x1b`\xe3\x96i\xc4\xe9&\x00\x94X\xbd;w\xc6\x87\xff\x15n\xd9l\x10\x0e\aT1=\x03\x03\xd4t\xf1\xbf8\x8c\x83\x8f3\xf6\x93\xd1Z\xfd\xf5a\f\xf4\xb7J\x878\x12\x86G\xea\x9c\x02a', 0x1) write$binfmt_script(r7, &(0x7f0000000080)={'#! ', './file0', [{}]}, 0xc) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 4.203356036s ago: executing program 0 (id=1957): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) pipe(&(0x7f0000000100)) eventfd(0xffff) socket$igmp6(0xa, 0x3, 0x2) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0x8000000000000000, 0x8000f, 0x7fff, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x9, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) 4.078624487s ago: executing program 1 (id=1959): mknod$loop(0x0, 0xfff, 0x0) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='clear_refs\x00') fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) (async) pread64(r3, 0x0, 0x0, 0x20000100008) (async) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000300)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f00000003c0)={0x48, 0x1, r4, 0x0, 0x3ff, 0x1}) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a090415a168b3d9828fbf020020040900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000440000000110800024000000006140000001100014fe7c558bca47ae8fa2c804df39c820000000000000000000000000a"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) syz_emit_ethernet(0x2a, &(0x7f0000000600)=ANY=[@ANYBLOB="0180c200000000000000000008004500001cfffe0000a02f90787fa5c662cffd4626635b5162da7a7bf8fd32c7affcd8d54511caa40000789f00"], 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r2, 0x3ba0, &(0x7f0000000180)={0x48, 0x3, r7, 0x0, 0x7, 0xd4, &(0x7f0000000040)="a9b0a7e479faa680c141d5017ea5adab2fa92037a97c8010275449fd202db67bc26f89d39d1f70d9c5cd0ae86b15afd6cb9893f4c894d449e655f76cd2a93da1ecca7076bd8b44ef2f37c2c3a1adf5054219ba86aad33a108e3d1c0c3e4adfc9315b95dfc53b7d6cfe3b47eea24d7b2728eabd87ae7f0f0d82cb800d1629d21878c6f74e0dfab85cee5dd3e723215d5be12eae586ffcf8cef82791dd4dd8c9001b44b3436ac31a1fa9930fea2035bec5f7a135125736041ba19d60a877da7962644e751e0a090a3661c7c5657f47edc7b6c2a8e8"}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f00000002c0)={0x18, 0x3, r8, r9, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r2, 0x3b8b, &(0x7f0000000140)={0x10, 0x0, r10}) (async) socket$inet6(0xa, 0x800000000000002, 0x0) (async) r11 = syz_open_dev$loop(&(0x7f0000000100), 0x2000003, 0x4040) (async) r12 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_test', 0x40042, 0x101) prctl$PR_GET_NAME(0x10, &(0x7f0000000440)=""/214) (async) ioctl$LOOP_CONFIGURE(r11, 0x4c0a, &(0x7f00000002c0)={r12, 0x2000, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x0, 0xfffffffffffffff8]}}) 2.887506339s ago: executing program 2 (id=1962): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2}, &(0x7f00000002c0), &(0x7f0000000300)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000110000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x20008040) 2.885921582s ago: executing program 0 (id=1963): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) socket(0x28, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r5, r6, 0x0, 0x0, 0xdead, 0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x4, 0x0, 0x81, 0x0, 0xfffffffffffffffe, 0x0, 0x80000}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000"], 0x0) r7 = syz_open_procfs(0x0, 0x0) preadv(r7, &(0x7f0000000340)=[{&(0x7f0000000000)=""/187, 0xbb}], 0x1, 0x2004c, 0x0) syz_usb_connect$uac1(0x3, 0x0, 0x0, &(0x7f0000000500)={0x0, 0x0, 0xfffffffffffffe7a, 0x0}) syz_emit_ethernet(0x11, &(0x7f00000002c0)=ANY=[@ANYBLOB="0180c2008d7db38f7d138971ecb660000e0180c2000001080500e40fb13d717574bd73ec78ca71027d59d6e6b3bd0cedc2afb0eb95c8dcaff136e7a019c284b2a185a7e3fb6a1564ede04f2b056668b90a8b9136a657ff789320d28ff8fbcb42f7"], &(0x7f0000000040)={0x1, 0x2, [0x9f5, 0xba8, 0xc81, 0xb48]}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x23, 0x803, 0x0) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300", 0x42}], 0x1) getsockname$packet(r8, 0x0, &(0x7f00000001c0)) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)=@ipv4_newroute={0x40, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x3c, 0xfd, 0x1, 0xff, 0x6}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_VER={0x5, 0x1, 0x2}}}}, @RTA_DPORT={0x6, 0x1d, 0x4e22}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_ringparam={0x10, 0x98, 0xfffffffc, 0x0, 0x0, 0x5, 0x800, 0x0, 0x100000}}) eventfd2(0x0, 0x80000) eventfd(0x3) 2.725922838s ago: executing program 2 (id=1964): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r0, &(0x7f0000002280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) sendmsg$inet6(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000280)="03a0f754dbae8f37f02ee53643de3992553aa66f3979a0f64641f2d6b563073b8b886705b369a4a648a152a1545858631dad337ac64f735e7e174affaa0141b664002ef4ee10d31d2afff2ef42c2a56bc78e10c0b7a90c95cfbdc7a5503c088e05e7aaa3ef4fc2cff74c02aab34e0bab69dce1a44d83d3b83ea98b24ed085a83e613edce4f7b5ad926596bf46cd7ac93aa5eb09330b112bd426dbc6d60fa7906b23fd0b853af6c55427d35ccdd78dd6be011094cd400a0ce55b575a9681128908e4b8e9bbab0bc734255b2419b88c1542a171e62f3fcc9c961f31d16c8997ff0d7d5886276f24ed1f5878b1ada5df013be0e0fab4b486e5e581c5fc94a6665c4285b43806f65c6966c03cb29475dcc2db19dc383535863574b95e97abafd86eb66610bb2d9274d26ee4e93372ed6c1", 0x12f}], 0x1}, 0x20000044) 2.552229532s ago: executing program 2 (id=1966): socket$nl_netfilter(0x10, 0x3, 0xc) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xe0a42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 1.923364708s ago: executing program 1 (id=1969): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x1c, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {{}, {0x95, 0x0, 0x102}}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80005}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x160fb5a9f24a6945}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 1.660478428s ago: executing program 1 (id=1970): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000010700c03f00000000000010900000009040000010300020029210000000122050009058103ff03000003"], 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x200001) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x4000000}) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x7, 0x4}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20084a0000004a28720d000000ee2c64a872188913cebae93f78a0f4468ff9e86d0164692c56043d53111e37090d7dd4871f5790ffe62b926b8df843ad2dff495c8e57f249a9"], 0x0, 0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0xfffffd84, &(0x7f00000001c0)}, &(0x7f0000000080)=0x10) socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg(r4, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)=""/65, 0x41}], 0x1}, 0x1}], 0x1, 0x0, &(0x7f0000003800)) close_range(r4, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000001080)={r5, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xa}}}}, &(0x7f0000001140)=0x84) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$KVM_HYPERV_EVENTFD(r6, 0x4018aebd, &(0x7f0000001040)={0x3, 0xffffffffffffffff, 0xffffffff}) r7 = dup(0xffffffffffffffff) connect$l2tp(r7, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x10}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x89b0, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x1900}) unshare(0x62040200) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea00090587", @ANYRES16], 0x0) syz_clone(0x4005000, 0x0, 0x6, 0x0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 1.659619902s ago: executing program 5 (id=1971): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000040)=0xfffffffe, 0x4) recvmsg(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x41) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x5}, 0x8, 0x10, &(0x7f0000000340)={0x2}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000008c0)=r2, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000880)=r2, 0x4) syz_usb_connect$cdc_ecm(0x0, 0x6f, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a440000000010109025d000101000000090400000002060000052406000005240000000d240f010000000004000000001524120000a317a88b045e4f01a607c0ffcb7e312a072414faffffff052407"], 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x60000, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000540)={0x1000000000000082}) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) prctl$PR_SET_SECUREBITS(0x1c, 0x5) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000001c0)={0x9a, 0x1, 0x1, 0x0, 0x4}) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x220400, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000800), 0x80100, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x800, 0x0, 0xfffffffffffff001, 0x10000000}, 0x0, &(0x7f0000000240)={0x1f, 0x4000000400000000, 0x0, 0x7}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000040)=@x86={0x5, 0x3, 0xa3, 0x0, 0x7fffffff, 0x8, 0xf9, 0xe, 0x7, 0x7, 0xb8, 0xd, 0x0, 0x800, 0x5, 0xff, 0x1, 0x5, 0xd9, '\x00', 0x6, 0xffffffffffffffff}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000600), 0x1, 0x2) r8 = socket$l2tp(0x2, 0x2, 0x73) getsockname$l2tp(r8, 0x0, &(0x7f0000000140)) accept(r8, 0x0, &(0x7f0000000140)) 1.590103694s ago: executing program 2 (id=1972): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x40000) shutdown(r2, 0x1) 1.589430081s ago: executing program 3 (id=1973): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x86, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010120", 0x50, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, [{0x0, 0x5, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad9648926974"}, {0x0, 0x1, "000000000400260004000000"}, {0x1, 0x1, "fe906d17efe3"}]}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0xc0802) write$binfmt_elf32(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000280)={0x1c, &(0x7f00000001c0)={0x40, 0x30}, 0x0, 0x0}) syz_usb_control_io$uac1(r1, &(0x7f0000000200)={0x14, &(0x7f00000000c0)={0x40, 0x9, 0x62, {0x62, 0xc, "3d0f11e1c61fa59c19272942e9063c8284b3201e7d52296737d2aa500453ec4626c2991b018773ac81e3a45d22ebcacda228dbe214c427f5fcb917b598033941acfc39c0e215fc6d6cb25e426ac79e0f222e7aad60f0771c71b089779ea43b06"}}, &(0x7f0000000140)={0x0, 0x3, 0x6d, @string={0x6d, 0x3, "fc6d42f0783cdc40c7110a703041bfb669c4ea95431c47edea958f424516f430cfda47e0534decc558ef1d845f1c531c87bad3bffd30df3211aee9061ee40bf02ed1185447778b53fc29964d473623496baa4e71fddf62aae312deca741c27d722ae706607810ad93f83be"}}}, &(0x7f0000000540)={0x44, &(0x7f00000002c0)={0x20, 0xc, 0x62, "839e55f1c0098af5ca1060d707dc77c1bd46ba0896e2f116616beed3ec365e690ddb194b2ec6b4ab73405cb494f1b961330356ec472df97193a5c29c2df62791c9e83ca4b31910e617fcedef4afc833394f69f3be05640821e158899004ad4ca6dc2"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0xf9}, &(0x7f0000000380)={0x20, 0x81, 0x1, "d2"}, &(0x7f0000000400)={0x20, 0x82, 0x1, "bf"}, &(0x7f0000000440)={0x20, 0x83, 0x3, "148867"}, &(0x7f0000000480)={0x20, 0x84, 0x3, "67fdd5"}, &(0x7f0000000500)={0x20, 0x85, 0x3, "5e0307"}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 869.391076ms ago: executing program 3 (id=1974): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2}, &(0x7f00000002c0), &(0x7f0000000300)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000140000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x20008040) 811.381053ms ago: executing program 3 (id=1975): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/timers\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="940000001d00000226bd7000fbdbdf2584000500000000000000000000000000000000d12af3c9d32b00000002000000ac14141f000000000000000000000000013500000201040006000000ff010000ff000000ac141426000000000000000000000000000004d53c0000000a000000ac1414bb000000000000000000000000000000000400"], 0x94}, 0x1, 0x0, 0x0, 0x48014}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000600)=ANY=[@ANYBLOB="1c0000f5"], 0xfdef) (fail_nth: 2) 385.971556ms ago: executing program 2 (id=1976): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r0, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, 0x0, 0x5b0}, 0x20008001) sendmsg$inet6(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000280)="03a0f754dbae8f37f02ee53643de3992553aa66f3979a0f64641f2d6b563073b8b886705b369a4a648a152a1545858631dad337ac64f735e7e174affaa0141b664002ef4ee10d31d2afff2ef42c2a56bc78e10c0b7a90c95cfbdc7a5503c088e05e7aaa3ef4fc2cff74c02aab34e0bab69dce1a44d83d3b83ea98b24ed085a83e613edce4f7b5ad926596bf46cd7ac93aa5eb09330b112bd426dbc6d60fa7906b23fd0b853af6c55427d35ccdd78dd6be011094cd400a0ce55b575a9681128908e4b8e9bbab0bc734255b2419b88c1542a171e62f3fcc9c961f31d16c8997ff0d7d5886276f24ed1f5878b1ada5df013be0e0fab4b486e5e581c5fc94a6665c4285b43806f65c6966c03cb29475dcc2db19dc383535863574b95e97abafd86eb66610bb2d9274d26ee4e93372ed6c1", 0x12f}], 0x1}, 0x20000044) 366.13876ms ago: executing program 3 (id=1977): openat$ptp0(0xffffffffffffff9c, 0x0, 0x481, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x8, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x800, &(0x7f0000000200)={0x20, 0x76, 0x80000}, 0x20) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000055aaffff00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 275.087907ms ago: executing program 2 (id=1978): r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{}, [{}]}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$uac1(0x1, 0xe1, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0xff, 0xc0, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4}, [@feature_unit={0xb, 0x24, 0x6, 0x6, 0x2, 0x2, [0x5, 0x5], 0x1}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x205, 0x6, 0x7, 0x8, 0x2, 0x4}, @selector_unit={0x8, 0x24, 0x5, 0x5, 0x4, "45d94c"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x74, 0x3, 0x5, 0x8, "928401"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x0, 0x4, 0x80, 0x4, "2c399a099d"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x5, 0x1, 0x3, 0x8, "", "3fb6"}]}, {{0x9, 0x5, 0x1, 0x9, 0x7df, 0xa2, 0x7f, 0xa, {0x7, 0x25, 0x1, 0x2, 0x5, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x6, 0x6, 0x1002}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xc, 0x1, 0x9, "739a1647"}, @as_header={0x7, 0x24, 0x1, 0x3, 0xff}, @as_header={0x7, 0x24, 0x1, 0xd, 0x2, 0x1}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x401, 0x3, 0x4, "6a18d91e"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0xf4, 0xa, 0x4, {0x7, 0x25, 0x1, 0x0, 0xc, 0x8000}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x95, 0xef, 0x6, 0x8, 0x7}, 0x105, &(0x7f0000000240)={0x5, 0xf, 0x105, 0x3, [@wireless={0xb, 0x10, 0x1, 0x0, 0x18, 0x2, 0x8, 0x8f1a, 0xf5}, @generic={0xea, 0x10, 0x2, "b7227f5eccdff6ba51fd73b1bc0e83d33effee53043847272d29f8807f5110ff97d3c6fd9d7c9481736c84956a967816736db78cc54d47ebd9401cdf9ab173ed4e337eb86872bf29338f8d8a81a3509ad1ec266d0917ee778ed75104a6465bfd983bfd6d45a169402189dab18f1864b277a1b7285cefda90afd378c492b5263b30431cf189bd37c67cce0d82d25438499aeb31c94b5874f6d2a56164ea8063e8023bcdc2720a026da6303f45be8f758695d4ebca1d9afed05be00530695fbf73d6eb8b2b5c919add5801fbd3a39d56ecaf7e9f9f5e5c2adb188119199a7cc1fe99e7b888264ec1"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x5, 0x1, 0x7fff, 0x8}]}, 0x4, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x445}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x430}}, {0x2c, &(0x7f0000000380)=@string={0x2c, 0x3, "386e497d319a6011f01f5cfb27db6cdc86779410e78acedc05a7bf085b67f3d81a545fc74541be3104f3"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x415}}]}) 106.090898ms ago: executing program 3 (id=1979): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000080], 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000200000000000000000000000000000000000000000000000084fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000"]}, 0x108) 0s ago: executing program 3 (id=1980): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff), 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000014}) r2 = socket(0x10, 0x3, 0x0) connect$netlink(r2, &(0x7f0000000280)=@proc={0x10, 0x0, 0x1}, 0xc) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x18, 0x32, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x40082) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000000000)="17000000020001000003d68c5ee1768812003208020300ecff3f0002000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ab65761407a681f009cee4a5acb3da400001fb700674f39b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) read$FUSE(r3, &(0x7f0000006380)={0x2020}, 0x2020) syz_fuse_handle_req(r3, &(0x7f00000021c0)="d56cea33946c0eae3241d3604bfce89adddb2eb96960338db7572fa254eb7c69dc0cb526989630e26224c258c8d70ccacc5564d67723f4756c0399174c5460c4995942d24092c36dc820e97344798b5bb45423f853bf50e374323abacf0388cd091016b7a3d7843f4d3ae1658bd34d967e3323a64908442788dbc99c1f4248da53fb5be2c8001236b994ca594e3b3c588beaf3cb1c32c072d768b9e665e7d87044fdfc1fd6452593e6793963153f3850bf85042a5c139799ba8f6cb8d877fc436c4f1601270d6e29d60a4c80d6315e46f4219494ce897127d0b76f5d681e90f4e9282468ef7993cd92076aed266c1db8b81b93adc4969c9b89b32b8768c9f39f2d148e933dbb651746a9364f49986ef73b4c29f647b82b83216bb8179fe5346fdacdc5fda4bd48875cd2f1cf57a0c9a91e059446bac310a6d68948675c35a8e442168fd84d78d9800e5b05bdbce3a6eac65bee7279a3628f2a08931d3d52ce490652c20f8ae529eaf24bf421dad976c68b234ee6f6210c9f9aac3a55c6939d6aa3805b95619546264ff3ff82d0dc690e8ead61b6ed528c3c117cd771a3b7feb214ce8d720640d97f14b399b7f46dc4aad83117e8e642ccb117d13f345536fc3801c124cfaf8aa7aafff6c8df3fdd4469c077eccbd8ddacad80d9113dfde26ae67b226185743b2d53667fb3016fe114f87484ab614ddf0887c4b2c85351ab21a0ece6c066a154b38b4d7c1792d2db2cc5f8ceb42078187949d354b7a08d1529f3d10814757179c860db031dad4a3dc13ca01d1013238ed5f7a9674fcc77f0d34e2118fb851c970d86ecf9de1cfdb8d3ab197480e263c3207c3d7ebe17f9547c7c56b08e83de875294d0fd68df1926ecac24350b2c70bd73e14122ed480c564353d34049e67c26036fc35d04022cd35d6ac00756d3b8550bb22ae80a4bd630a00268d07fa249b0bf545dfbf01bea2f12b30738c6e13156244eb24e6d69ba7c3acdbbefe8bbc06b821aebf836ca07a3cc7b6b24686ed8f3b23085c893e72188b797651c5ab5cceb1465414a325f793a3af6d06eed7eb734ad05bc1f6619e8485259f570a482a67273ee01fe15dd938afce026f1111c7a38ed6d1aba34f009ce1e99140fd0db2de74150541fd48dd2ec5b1d15669de2ffe3a198184b6186ccda31aa64c585ff8cb65b67fe1455753895a88b6ab4c6bf1bb8329739178147e6f15801bfa707bd9ec9da662573ce07af684bb7c880a7d63b0a0a7300881408c44e95c679ea32b0eab845d0b333f245e8d6006258678704aa8cccdaf80cc46138d5b7a0804fdfa34c91d61a0d2fa6c62e7d1a675e5743f845ab40ea5df0182d6eb9781905c94751c75a411699a76f48433142c5f109d5dfddcc0b1dc6254efd5ea50d6ffbc7b9ca031e1a0123844b63c48b964645c6d24707582825e219bcd61677ed4fc45ee1f4be91b4c1b856d65a86acf22b8b0d588bc473248ac040326b1490c2fea24bc0c0a721e2ed63e39973cd4d38df1001dba9b9d995c229655dd26f3cd3d64077ec111e2c370717cb4cd068e0d3a52f1027d3df953e1f1ac768a7215a3695722b1b6714ce43801451a9532212b651d073c780d61712aebadd145c1cd95c1dc0dcf51850046ae5771e365f45858a36e48afe563ec0afee3803ff6a35bc25217b53eda39bb813b8d3d728c21a0b80d014003143666c0d1398cc46a01aaaf97117edda217f984010e7c5cf32535a669d4f11f6b70e3a3b823987ef7c9f878415063bf05205e13bcf7acb287bd0bb0fce77529a711f0ed145ea2ecf2194658dff17c5681cf8c7ad8521d235a705292af4878b3f124be2df661026c091d6c07aae1a74c919f7478d1083f70b3a0fe00c2e220ab998b4595268b6f7cabbfc85e59dfb6ab7a794cd3fd70d5cc4d70ca933a4452df5a345cb31f3267de53519ba39c915d492cd4652843f1d30a5fb311e3b5d868347969f013c5e3b4841b22240abcb61a14ff567186766ce8f6ae64877f672835dbff4fcf19c8230d8a402397630effb698a8b0c9a28ae028d7938ffde488fd64113085bce504cd0551e0eb3730c3f781cbecf0c41d2338766d3f6096661c1f1bec3162b8a0c4099fccd9480e821df8782c2e070530befb62bccd8539fe9dc7d8d3f9bded1bb34db3f2d6050885c8f1d57f5e603f629de7491f5fd9fafcceb565abeaec838b10a763a00a4607d4330bdcedc066d8cf9790d806e03c219866bb8f053a6e602645436d1f469df1d5008f5dcd4bdb7ce5b76ec015a8f4693cb2a63ceb2be00bcf221f0ca32db4efaf8f7022622b335fa8dea4afdd86be10be6c4d66e5f57416add4480509cb98cf31cdda84644eeb782eea041d4bc0e005a20bccc3c4a08cefcdb91cc2c61d9231c4e36e96f6edd2133f9b34e7da90ce20d1c60ff223c6a204bb942766a359b923573bbbaf2a827d79e4f649e79a840216ac4ddb3409c94e71ff08d109bc3f0cf6583219de7d7131a956f835ecf5c131a0b1e056a86d800a0204243f3b695029578c064306a31db53f28a8f0c0302486cd05970904e9b5c53100ac1aabb3110a89820e4d8307c3d46084999d0456c53fec61a9242b486eb41a90f3300fdfd0d8a472e8da7a842588721d1df1f5e4cc425efebc75a904ef4cc881346a4bc23eef4d492e3efccebab86ae4213f42671370579ee7f8341396e9515619e100a8fae2c5cba0139a088579ece7a603c8b8bab9998223fe862dff8480aeaa5970c90b894e5f71c2784e4dfd50ed3e9ed91036e8356c09464de13b4a95227203133b2c2c71cd6323492f083bda58ad7721b6666b9cd93f93f0288482813fd8aade02cca81cd35257e023504ac4f86be1c7a810b67c6d7077f5cdbd305b618a05c03d196894bfb1a6ff511e59ac8ce45d16cee95e1de0797a543728caaa43e5ae42a12b6bb7910d18d4e1ea89d264491287eb23a76095a12a39c46a7c85349e2969edaed3c1fa6a2150494f63f4c98c65fcdd650ac7424ac1ae64421294356ac1e4dbf9d4c817f081f4f7751ebf56788d799bac29dc0bfe83ead7ab3e338b8b84df4cad2b549aaac4e6048a6fa8f8f6f1f7e0e51c8b3c872f18c466e590222b03230f46bc8e9a0171bbd2096c7a480d6a6f29bd74b60105bebda42e59cc830c4b31f6c52687b4ec2ba869149ae363d711d099f94ceade1ada193e931ed9aea0a280ed5f25ad5ab3b4083f140ca17b43e5f6aef2c24a28a0262c80a040187e052ea7d54a528b6fcc176ed3afc07fe6a661d050fb4a3a6abfa3dac5f3230540b45af060781cb5499c2894d6a4a2bf908ddd48d6b34207f56c31229e206c88db3552ceb6e82a0fa2bf7f97baf603d37d6a8b1f2b1f5f95b251129ed05351681908b7cf5cf6cc86dd854174cc19713b4d262b021952b6da5f20f57bbacca62f5b7124409aa625bbea59819baebc1bc2dd188feba48c998d0dbed60d44b8a4f0ac28f6c1c8c9998f7406f1a34e4ce902be2420f7ff51a5ab3b1faa86ab2ec1edbea2493cae090abde43ff27d685c993dedb24eb255772cc56fbd104f4f5275f10d54d7cacb8cbf188ae1a4d29ea880068fb2696b3ba6e8a7c15939e1f7c394ab4bd4c4bef2383121cbeb18646a8e013d570cee3eeecd7fbe84a619f8aa2e34f2e1e9b99d0c7d7d179d9df8d2e2f1cd7ba2c7e60166dc14e5e4ed9c41195935e2884b5bd0057ed0155a5d4c6482e8f554e4cd0d0aef7d6487801ab54d54eb41755d833ab83883b40f47595063ad2a0fee5c661f86b8ab04ad0047d988ad86b3c520eb78dc3d750a57e777f5d766349f1a687e090f744206cb5d048346061b414060f6826d8a884e93f73f1f1f4cb8bd6e8d1215d436d390dbda35b555f550e11e6d8008fce1c429bd9bbd04a1fbb9de28663c1be4d8d7e506bc681ada28a69014b972919b5f70cbb770349324c9af0b7ee7ff4cc8bfe807fb9faa0a69498448b22192d578a1e82582b943051beb543ddca8b643ee6c76ee32278aa8bc92b44a8439a24ed5040545349ab05e831d4511a8da03ca539659585b2267a73775f1cb7c2c5548d3508c896f99a8e5cb55160ab1267e320ac2d7c8f8b57079dd14d301636a1374e24541f8d453978998ed256b381bcf638bb372ce1ebefb341656c02f4092a7667ffec5505e4938dcb03d404654430e244f9f7f7d0fb4189a93f7c2bd7a4fcb3ccff79e41a98adcac3e4c19eebebaec15bd8cea1df0e509cdef62ae10c66734d162caf35a6e511baa717f769c2e449892224fa8ae78de9138cf6ea1d939998a8cb68b0e83cf604e03b99634796d3d495e4617f8fdd9764631e7ed6eafa797deb1159259777bf2915d48b63286f6d6528ad4ca5783609263d9a03aad41ec8ef1e2e1e77734d27229f801192be238468854945c20dab4e1baff9dd593361efda1de95e04561d33cd73a45dff5f85b2e85b0747a49345ac8d38add8ef9c14685eb3d3432f3f994e3ddd4e45b16005870485253afc4f08d8a6d8023b722284d11d56c6ff9209a5bacb7ce1708244bd21878b8cd5c13ab453bd589f6196322de9faede39ce6f94c75d008d2d7ced27a2375cc62c3d5c15c1c4301a01299d8f4c41e5a44e4130e9555a356d6b19728c7d3c86cb9a1ddf906ab63a9447f8233bcd09bd74cf9749f085f0c4689ef40dbc41a7a299f0f891d9d0d3e39409d4d774da53bfb6e8ce668ce50885558e909add2cb9bda2f7e9232541b1a7f742a99740f486ef4f7c98e4052f2da705c56a18d5a8289ae6cbb9dc7de13a8cf420b7a930abaae813b40517d84ae984dfc94cd1021e0e4a7a9e7de841018d474083ca28a829ee03fe625cafcbedadcdef6621ccd679fcd9c9a9ab2136211f8c9a679895aa39facf2d6668e5098b3dd8e0ad78d8caf250dc38f2c9518bccb353ef3418d3906827514c1959d58344ee11a0ef1c1424495cc1a9910187685a47d6dd91f07e5081c5ac3f1b6e363069694dd9072684c5ab0ba56157c10f5fa8409e5bc43b38b31f24a306ca5f7e3de9a392eac1984e877ecb3dfd044f1449b4ae9b586051b1780c0ce462919f4a4b54ad8011d013c3962fc6697d33c2dc6771fec664c82cb16144619b207deb4391866d6c1976b945c5959d19018f15376ce3b05666747743527f22b54171da4dabee2f4e469a5521067de4f92e2bad02e15e812b6cbd27ec88a9eccf600ce7f5643392da9ff6b6412f8e7c68d8c8b9e0006e41777e2a1363a9556befbbb110dff3a84b179da3838acde0b25f53798733a9fb463d76b630aef7c8a43f6219482b34b893fd99cf3a013ecefde7c5c6528e304c1868ff3fd8dd5aba348a05dc950b1c4c281cbb28b800d6d0da180fdee06ec3bad6f97180295ed1d77078156a885b5b0c501ea563e8871adb97dd6052de0ab369bf2d98f434bb2d172d9967bb73d3eba6b52bb8d55d8963bf58d310afedb51c0f94c7814b6da30fd8056ab7be74ac31b1b75c217e3ab93eadcb2d253e5d8bbe47c0f1a411a9e502cf4301d898d905cd5db828e56a722394fa11cca64a03a42e7fc1b3481b71ca0b6a3d9bd1fc8229f7f9d3e6aa0d48051942579fb759201d4715db9a2d399e0745a66dbbd571accf1f2e15573ce832e91bd1f042ab758d9ec13e354f38454cc42668c8d60358916f7e937015f6c38732bcf6131ecde001892cb20fe47153e7e23b1cd2fc4a22662e7bde09f7df10fcbf475783fe23a0fdcb2c3bd8b28453ce523ac19ff77e68c3e9fa0193b796ea68f44132b3a96adebc04181e503f52be4778ef422ce3e6ca38514fa18b500ca518590479e8c73a7942dc2e237d82cda953ae1b296b97ee8ed62e2e755d6ddea7c0334e1b8d76c278bdc454724003106cb6fdc85340d1e784ac8b6551eaabc33c502163ce0d401627bd22ba6be90089372bfa3f91ee745e45844ef8dc0fe3936bef07f9c1d3aadfa4c8e99be6b038bed6beb9597add881da2acc1a3a471f500d68f639cd2bf6f4afab919a2cf747bcbb42b95684e8741b485c3297cf07c7bd98d6653421b61f701a06b82be0fbeecd32eb00feca9c5732bb5e565bccf8c9feb27a50760a785bbb50402768cbd458811e284a604b3374faf3480e1736743665617de9c32fd10e37105ac6dd5303f1a6dc78950bce56215c2a2f9e0ccbc0bf9fe8ccf7647ed29e2aa4948689d681a7a9fe582631338f3eea3df846f28564038ab75aa2a8ee5416b66ceeda9d8f56ecefe07f6a21ace83a2e15ad408d0a480f56708e3d1c96020b124c58f6ff5247f73aff7f77d389167650b8a0b98c97f87a1e5d6c08fa99874ff144bfa905e9da3812f010eeee00f3c9b594450faab5342e1b6e98fed5714a802b67b3e5b1964a62606aacb8222efd4980823f076675ae859e64de7b08f7a0b3d8bc829e1a93eb3b4975b4761cd7fa743e393da537c91f658ea2b23c94244498cdc4bc32c8b9859b9d9792eeabdce635b2d61c311949204826054dba0880505e2b53cc3521fa8b68bbba2ec05050bd3244c02752af1555625ddf50a3656c0043005c43c26a2dc907d5dd67efa831ad974151067b436a75fe99b8c94c9ca9737279fa1aaa09b0108c48c79c7e4ec1eeccfd43aa8e7ab6cacf5a956fc47d4ce77fe719d6eec1730d3e3b3be71d313f644177b6d16df0180848c28b850fbf71168a1ee4e5639bc46f2555b3984dbb91520538dfa6a1905abfb7238ff344d0a7d760f040718a57cfb56634e7de7584097f69f87630693bcf410796266cc3f50302feacfb556bad2506b7191023817527dfe5973101712bda922472076633133a11a76e8bc7d763a2cdaa53fa8d47d442fcc572f791d66d10d8d6a9058ecbbcd6d3dbe45d67b75e1091dd0368bea33ef0f56ba68885630429c24800922062e1066f2d4c4b795332ab03239548df4e6e01c432fe5eb29e8e63f6c7ba4f2edefa208c69e781786e4717c2f71dc2032a98cf1e6d66c10831e17ee776edc6b060ae20d025dc570a88e17da771acd32b7b93d46e43a917b8e2ba8232ad2707324b9b04dd8ee50c3c5a4372c0b1461ab2b7424faf00c7162bd8e8ffc7fadcb055403b0fa7087226ba4330e746af97a3f915f0b9e105759e81fe94a0df0cd6c324fb0b871491b5516c2fbc82c77b07159e3f4c0b7952b74cb4e203a69f241485191e1afc76d12a56db065b0513a41582f655340603c73cb39b728c97d1e919ecf963b91ec2282d25dc426db873394055beb0f9ba20545e2465ce2d0d962f42e1e4c79bdea4cd2829269ff7ef650bbeb5083d39dc7aad668af0b01c521192c548857473b29991f7bb917b5814fe945f4c3ed9bbe0563f4004b391b76860e9fd6b7c0baae82e4ac033f62a2c6ce6a2311b8700b06b5215e604a9b99d37e00450fc7790e893176e9fecda220f838a078a8ef7da7d499b1fe0eb8780c4b9705a6a10674e61b5c228fae1c13488f98c10c1792fa40229dba44b1cb534f9fab6a14407687761d738c91f4b8d4371a1de1a47bde0563a6fc88c4886be5d48c4cb89078c255eb1639598379daf50a672cbf4d8add2d4af6c02aeb1d0f86b611abd363409c7c7fc0b66f307ad3df24241fe06d0f7617d6c3987bb9e5d8f1712aebf095fad19b3b4fcb9cc4fb39012f333c4b040666259ee7bc43cff299a527a8914d71324e91c774b84e9392e615453e9fc648c539059b66f780c888892fe8b30eba799ed18fab08ebc3b9da8bc12a249456351bc0ebafc9f54d5d24697fb53eeb5e734527d690620989f605f57dc65a15a754d304be592acc616cd528b6986064b4457b96cf1fb0ab383a0585acf9887b18e1d6d3aff1e7f2328ea0313a2b36f6f79d671d9ddc4d34fb8fb55a596b2a16c63757083fb4bd01be2e1d82e47c5a44e052279097c5a18feae9884e102cf087611a3b94467ad61635dae6275974f6e6ca7a42ded0ee4577574d56b142853a8c955d92d1eb780de11dc9289acd193214ed4c9f5f26d0481cb3c0c0b8d4c9ad929c61ffeed66bf2e4f7018049593b99358d93559847d55654cee93da30f6578d2e295909791d227a12c09cd4a0edec25d3155086b64a787997a53265cbffb7fe6a2bfd589e12b4d0e21a600276e920397888443584aa99a06d7cfef8e68eeab8fa739c3d8fb74581ceff295110742e763320bed3a4be982b3ebed15ecde37e849aaa91959327d25149f38854ea1137f870aff99979e5e74cc9e45be12e3f0f9912a0955e718a4917e835bca50f43ce92a6bc60ed006b8f623fbacebbfb3dcb4fabd9941a5487c6f637de9a2005a6bc4062e1210a08a51d6f8a5e3f6f97fe90dc7e2e21d4d2f038c0fbc1918aa00e230a4a0e5c41a4808fb9a731271fcc1e73713c9592aa4b2ddccd0d13c3cb68d51166623153445c9ec955c6870dc8543c0684883186082e34ea5714febf8b46921015c3623220d17529896e1a6edac6e32fea2ba30db203238300353602c17dddad7608cad8170b520f6d9d32cdf0156a1de4e9b9eea78f73255ddc6da6994a6018ff900d9886590602ca6a072d8aa5645e2adac0744e2d5b2e1038c746635d5814692c3498aa9043b68f8ce79c44678c5a7d5bc26c085475853b229b2af3dc822ec58047f313c778aae2b64995148174e42908f3ecacd3921855790c0c5a25814416930293010b4f917979d837f4ef9d2d6dce804f5c0926244097746252124a6e0055559ffab197c38778f717362152af8f6dbf7ee03df050ab9b8909556691c2c2775f0f9c26a545db7ba698a4ce37de877705ea97ac0a002db274ea8360a4aa732c2d5e7417138c60cbea69d3b4993ada6a9d8f51d851543a6500a31bac5a057dbef498001f08a44e3c4141900e18b6d73c28c8c67dca805edeb5376384cefe75be1f127225e4d9724b7047d68fa2ed4629e91711a37c80158a07dbce78918931402b472a98a5d5c6b66a2d116314577e94298c37bc441499a9ecea132d87c5d305a0f8f0b3ed16f3b820941082c73b28391d8482ca0cfa78e1e09aa588b0eb1849c6c7916a6bbe56134a6bd93ea306dec125982628dea1db6d022d210627959e1dc819c841f173ed25f356909222e481a1ebb31185fbaeacbd359d2779efe4554ccdac7f4bcc528f656a45049331e16e9c0c796423ec9c7cba15c69d4a8a7741699910f33cc9798a8bf1e48182f08029a14d0131654fd388225d7509e1d7a484e9c7df34d1680bfc6b8d1f6f3920cc4113509fe42dfbd6b261000da9651f7e18088f6c2564472046e5eb7e8c9f8b5286a7452741a7103ced710bfb8e699fb8b1a85c0ae887cc06ef2ff9e2a2b1a77bb4d44ddd4a4e1ba60afcb92baaef108b60486d409889cbb2b1cc77ddff7e4b6caf8cf3488764d84bf3605eb9df709ac6cb36d1a3de89cdd6657f0e6b4009e6dac5d9be14f4ed997cf61e5aaec932520c321359cf286adf6e2dc3094794ae61a4f16089d06e3dc62c958950e73213c1e865c894fe7b8a30de65f5534a1e9c5d19ed49397980126322cb9c72c46a86d7487571300d85b3b5661555f20ab63a78f846c1b8f51a19610a11ffee44f7ccf0f1d67f4148b2c828d74c7f3993965c9067114467a71d242113a68574e28601fce343a023ecc68a72d75259f9a5dce144a7f61ef327192f6474d2bbd06fde3049fe7fb306ba3f54337008d7dbdeaf28a37a224e38ade23adb076cefd3148efcb62539a96d4dfc53f369e34c3d493ac3a5e8c8881133be630a2a906703da62ce7cc02ace9f666d6c3d4b9763a83548825ee1efb54ee3475b09e2616c5bdde3d193181bf020e8ac9ac25f32604b6c11de8ad1a15b9f908c6d7e79181aad1d741b7434aa92597a835c53b9e4b61d6069fa4ee921824d17c98784a8c04590f8d2cf877662b410cae4ebd1ba3616074c020d8cb6099a095735635490d318821310ddd016150edb80370b8d4e2f05557fd619b17192c13353cdae76d495821c610c8641e5b3dff1e7f2ea77b17810ca7975b8e36b7f501a8710b326ef92672096ef66598510902fe663e2a9ef00c3a052f1cfb1739fccb4371f8f28bb92654de5bf87cc2863e92e6d7e4b45d773f90f434eafc8f8398a48527af829a6cae359e7af5941bef158f53798058351107ce58f79ed21036770f6e10e7da92bbca25f369ee83a0f894bbf366a1361f8125b4ffd8e8b4d47ec68cd6b37c840cc5beb8cf65b2269ea1a0e9c371a571f30458ff8ad9bbf8723c19ddae1de5ca7461a436ffcd103c01a20f3252ba0965ee928cfb0d002b9aa4d4f20c805b77e67c8d991c4d07e5419bec9626a32c115d28253dd5f16c17182c1779edf49bdfe3823d87fec88929801163a27bfaeddfd8cdccae8cc3bfd6a9f2e2fec5971fa560c434debd434ff4d0058dcb05d9f3ac5193c458472d6d1685f9f46c8864900c5edbaeeee08971ee1c087f2e11467ff4766743bccf9e3414feedd6dcb904b92a05eec5de8db95444b920c995c770edcedcf7bffc48836c8f30037dde47f0e66fd79550de0ebc3c0c3eba0b66e2a353542eeb20397800e5f41635c5ec2f9a271461bcee8e570ddf945b186f15ab5cabe2a3123189935c6b9010b31732c425a9b2582b097486a5a7b1880b2f16104484e1ca83fa9c278b87e30e4b0cf6ed66c87a979c05683ac94a295d1c53e6f0975a079dd9a2825fdd6ae0926ba1a69f3f69f408eea9d00fbd43235a52c53d11963a611b81dd9f5e05582e1822398873e883662a64c225be19e0b85e102e23fb73d5dcb11435a5437d7418b0409f2e60793038f55ed54c79882b3a17e74ae2148bd558d131dbf446edeb0d05353492534e216761cfcf6582d066a8235a2bd5eb383350a52d7fc2761514e27b6125cb3e387c103dd62e31f5b789c217811c80ccbe3f10fec7a19ad32dc9271368b6d6ba549c45dfd8018507c40962b6ac6468c3078edb71d8ec7f728be8cc23dea1139ac30c2e8d0fc077280e420fbbffc896863db5f1e76922d7dd8e4479c1be822e74212c6f74765e108f916a1b83f6efc8ea54080e9a28b1ba5813a1fefddbe2d0cda413ee1463985b51b59f818f440c9b6a10e4ebf71d37995ae9694ba5867ca2eb2f7bf4e58d26149f2b25943fba216beb3de1f954bcf1bd32ce358b5d23023ab456ebbc493ead41e25b62b5b4ace6c5c18c9a8d512a9cbb4dd59f33663f6138d6b06bc8eb1ec9caccc0077b2e68e7a09d412dfa352e7e5c3942b710ab1648e16d0adda424d9fc2d15c619f4e8093c2b9521e4cdb3f22e655f52ce0fcc1bfd94e56cba8decadb68214451be53f9286c82d2a4912bd2394d1133be908409d791d6d8c2194ca37a76a38d6d0a1fced6478848891d9264cfc08fa849d720339ce00977cad8d9738372184098a7333dd1564d1d7754b4aa4afd6217585804159d31f53017869cb78b718c837b7fd176ce19e3d6996b6f055ed3ba7cd55b0349676c0c113c33d070081ce4ef29af156c4ac8ce760013688d0295d90271e23ef3ca10ec2b3b889855a153c867ce79297a10a02d21e5e8995fbc10d2f4d4bf521565376053b80937bfafaac688108f9962b7c72cf0111874ac8ae27d024ee2f9d57f15b9910a7486ef7542c6629fb0520c93a445542d", 0x2000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) io_setup(0x202, &(0x7f0000000200)) kernel console output (not intermixed with test programs): fr=1, Product=2, SerialNumber=3 [ 543.654015][ T5894] usb 2-1: Product: syz [ 543.661005][ T5894] usb 2-1: Manufacturer: syz [ 543.666362][ T5894] usb 2-1: SerialNumber: syz [ 543.674231][ T5894] usb 2-1: config 0 descriptor?? [ 543.690888][ T5894] keyspan 2-1:0.0: Keyspan 2 port adapter converter detected [ 543.700345][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 87 [ 543.714518][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 7 [ 543.737904][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 81 [ 543.753522][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 1 [ 543.772910][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 2 [ 543.788731][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 85 [ 543.845038][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 5 [ 543.932195][ T5894] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 543.948963][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 83 [ 543.968797][ T5894] keyspan 2-1:0.0: unsupported endpoint type 0 [ 544.088786][ T976] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 544.098962][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 4 [ 544.107939][ T24] usb 6-1: USB disconnect, device number 66 [ 544.183763][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 86 [ 544.284121][ T5894] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 6 [ 544.329207][ T5894] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 544.349400][ T976] usb 3-1: config 0 has no interfaces? [ 544.382353][ T976] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 544.442005][ T5894] usb 2-1: USB disconnect, device number 101 [ 544.460018][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.481267][ T5894] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 544.505881][ T976] usb 3-1: Product: syz [ 544.522030][ T976] usb 3-1: Manufacturer: syz [ 544.540170][ T976] usb 3-1: SerialNumber: syz [ 544.567027][ T5894] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 544.585900][ T976] usb 3-1: config 0 descriptor?? [ 544.636893][ T5894] keyspan 2-1:0.0: device disconnected [ 544.759054][T12138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.931962][T12138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.222475][T12143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.257477][T12143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.283669][T12141] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1559'. [ 545.327233][ T5894] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 545.337452][T12143] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1559'. [ 545.363107][T12143] bridge0: left allmulticast mode [ 545.465663][ T976] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 545.557292][ T5894] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 545.568530][ T5894] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 545.625152][ T976] usb 6-1: device descriptor read/64, error -71 [ 545.644155][ T5894] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 545.694753][ T5894] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 545.715077][ T5894] usb 2-1: New USB device strings: Mfr=8, Product=0, SerialNumber=1 [ 545.799499][ T5894] usb 2-1: Manufacturer: syz [ 545.817839][ T5894] usb 2-1: SerialNumber: syz [ 545.940868][ T976] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 546.081019][ T5894] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 546.105565][ T976] usb 6-1: device descriptor read/64, error -71 [ 546.161182][ T5894] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 546.190618][ T5894] usb 2-1: USB disconnect, device number 102 [ 546.247234][ T976] usb usb6-port1: attempt power cycle [ 546.625739][ T976] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 546.663198][ T976] usb 6-1: device descriptor read/8, error -71 [ 546.876660][ T10] usb 3-1: USB disconnect, device number 91 [ 546.879620][T12163] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 546.925734][ T976] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 546.956515][ T976] usb 6-1: device descriptor read/8, error -71 [ 547.023675][T12167] xt_socket: unknown flags 0x8 [ 547.065817][ T976] usb usb6-port1: unable to enumerate USB device [ 547.221685][T12174] binder: BINDER_SET_CONTEXT_MGR already set [ 547.238123][T12174] binder: 12166:12174 ioctl 4018620d 200000000040 returned -16 [ 547.504824][T12183] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 547.686070][ T10] usb 1-1: new full-speed USB device number 112 using dummy_hcd [ 547.884525][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 548.008992][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 548.092998][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 548.203814][ T10] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 548.226006][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.239502][ T10] usb 1-1: Product: syz [ 548.249023][ T10] usb 1-1: Manufacturer: syz [ 548.289824][ T10] usb 1-1: SerialNumber: syz [ 548.324311][ T10] usb 1-1: config 0 descriptor?? [ 548.338269][T12179] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 548.364055][T12179] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 548.433864][ T10] usb 1-1: ucan: probing device on interface #0 [ 548.623349][T12179] [U] ¹ÉMÙ­ÕÁQ&’Ù Kœ4 [ 548.631397][ T10] usb 1-1: ucan: could not read protocol version, ret=0 [ 548.728479][ T10] usb 1-1: ucan: probe failed; try to update the device firmware [ 549.200886][T12233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.276501][T12233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.540853][T12244] loop8: detected capacity change from 0 to 7 [ 549.575162][T12244] Dev loop8: unable to read RDB block 7 [ 549.637868][T12244] loop8: AHDI p1 p2 p3 [ 549.642416][T12244] loop8: partition table partially beyond EOD, truncated [ 549.652052][T12244] loop8: p1 start 1601398130 is beyond EOD, truncated [ 549.668585][T12244] loop8: p2 start 1702059890 is beyond EOD, truncated [ 550.443259][ T5830] usb 1-1: USB disconnect, device number 112 [ 550.577083][T12252] xt_socket: unknown flags 0x8 [ 551.275764][ T10] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 551.795561][ T10] usb 1-1: config 0 has no interfaces? [ 551.945709][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 551.970144][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.030981][ T10] usb 1-1: Product: syz [ 552.035181][ T10] usb 1-1: Manufacturer: syz [ 552.085689][ T10] usb 1-1: SerialNumber: syz [ 552.114663][ T10] usb 1-1: config 0 descriptor?? [ 552.197376][T12290] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (48423) [ 552.245832][T12290] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023 [ 552.409504][T12292] netlink: 'syz.2.1591': attribute type 16 has an invalid length. [ 552.434239][T12292] netlink: 'syz.2.1591': attribute type 17 has an invalid length. [ 553.007576][ T24] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 553.306559][ T24] usb 6-1: config 0 has no interfaces? [ 553.321469][ T24] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 553.340907][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.366537][ T24] usb 6-1: Product: syz [ 553.377834][ T24] usb 6-1: Manufacturer: syz [ 553.391231][ T24] usb 6-1: SerialNumber: syz [ 553.453849][ T24] usb 6-1: config 0 descriptor?? [ 553.800596][T12301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.811088][T12301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 553.844802][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 553.911142][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 553.980576][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.043197][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.114497][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.473005][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.599125][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.651356][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.687054][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.745611][T12292] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.754609][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.835641][T12292] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.853538][T12292] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.894340][T12292] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.903941][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.950730][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 554.977441][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.001085][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.014352][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.064499][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.142529][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.174864][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.246779][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.431151][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.525047][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.597434][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.605237][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.682746][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.694391][T12316] usb 1-1: USB disconnect, device number 113 [ 555.768693][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.795515][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.834957][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.848372][ T30] audit: type=1326 audit(1748082191.251:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 555.870852][T12325] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 555.881792][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.918030][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.926470][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.934372][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.942625][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.950501][ T30] audit: type=1326 audit(1748082191.251:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=274 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 555.973574][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.982299][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 555.990755][ T30] audit: type=1326 audit(1748082191.251:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 556.013417][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.024864][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.029387][T12325] usb 2-1: Using ep0 maxpacket: 32 [ 556.033413][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.048015][ T30] audit: type=1326 audit(1748082191.251:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 556.070854][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.120103][T12325] usb 2-1: config 0 has an invalid interface number: 151 but max is 0 [ 556.128948][T12309] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 556.129154][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.147057][T12325] usb 2-1: config 0 has no interface number 0 [ 556.161289][ T30] audit: type=1326 audit(1748082191.281:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 556.193796][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.205995][T12325] usb 2-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 556.228359][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.271312][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.292058][ T30] audit: type=1326 audit(1748082191.281:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 556.326841][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: unknown main item tag 0x0 [ 556.339640][T12325] usb 2-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 556.364491][T12309] usb 4-1: unable to get BOS descriptor or descriptor too short [ 556.381868][ T5830] hid-generic 0000:007F:FFFFFFFE.0019: hidraw0: HID v0.00 Device [syz0] on syz1 [ 556.384533][T12325] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.400084][ T30] audit: type=1326 audit(1748082191.281:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f374e58d2d0 code=0x7ffc0000 [ 556.400136][ T30] audit: type=1326 audit(1748082191.281:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f374e58e56b code=0x7ffc0000 [ 556.422437][ C0] vkms_vblank_simulate: vblank timer overrun [ 556.609934][ T30] audit: type=1326 audit(1748082191.281:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f374e58e56b code=0x7ffc0000 [ 556.651518][T12309] usb 4-1: config 1 has an invalid interface number: 43 but max is 1 [ 556.715546][T12309] usb 4-1: config 1 has no interface number 1 [ 556.721752][T12309] usb 4-1: config 1 interface 0 altsetting 247 endpoint 0x4 has invalid maxpacket 600, setting to 64 [ 556.765578][T12309] usb 4-1: config 1 interface 0 has no altsetting 0 [ 556.775835][T12325] usb 2-1: Product: syz [ 556.792827][T12325] usb 2-1: Manufacturer: syz [ 556.797909][T12325] usb 2-1: SerialNumber: syz [ 556.815129][T12309] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice=f6.75 [ 556.824993][T12325] usb 2-1: config 0 descriptor?? [ 556.842074][ T30] audit: type=1326 audit(1748082191.331:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12339 comm="syz.3.1596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f374e58e56b code=0x7ffc0000 [ 556.864831][T12309] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.895215][T12309] usb 4-1: Product: syz [ 556.926339][T12309] usb 4-1: Manufacturer: syz [ 556.946597][T12309] usb 4-1: SerialNumber: syz [ 556.961387][T12322] usb 6-1: USB disconnect, device number 71 [ 557.091008][T12324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.100055][T12324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.212645][T12325] usb 2-1: USB disconnect, device number 103 [ 557.290959][ T6034] udevd[6034]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 557.499351][T12357] FAULT_INJECTION: forcing a failure. [ 557.499351][T12357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.554749][T12357] CPU: 0 UID: 0 PID: 12357 Comm: syz.2.1600 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 557.554778][T12357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 557.554789][T12357] Call Trace: [ 557.554796][T12357] [ 557.554802][T12357] dump_stack_lvl+0x189/0x250 [ 557.554830][T12357] ? __pfx_dump_stack_lvl+0x10/0x10 [ 557.554853][T12357] ? __pfx__printk+0x10/0x10 [ 557.554876][T12357] should_fail_ex+0x414/0x560 [ 557.554895][T12357] _copy_from_user+0x2d/0xb0 [ 557.554916][T12357] memdup_sockptr_noprof+0x95/0x100 [ 557.554931][T12357] ip_set_mcast_msfilter+0xcc/0x320 [ 557.554949][T12357] do_ip_setsockopt+0x19e7/0x2d00 [ 557.554964][T12357] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 557.554980][T12357] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 557.554995][T12357] ? aa_sk_perm+0x81e/0x950 [ 557.555013][T12357] ? __pfx_aa_sk_perm+0x10/0x10 [ 557.555034][T12357] ip_setsockopt+0x66/0x110 [ 557.555046][T12357] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 557.555064][T12357] do_sock_setsockopt+0x257/0x3e0 [ 557.555086][T12357] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 557.555102][T12357] ? __fget_files+0x2a/0x420 [ 557.555153][T12357] ? __fget_files+0x3a0/0x420 [ 557.555171][T12357] ? __fget_files+0x2a/0x420 [ 557.555197][T12357] __x64_sys_setsockopt+0x18b/0x220 [ 557.555221][T12357] do_syscall_64+0xf6/0x210 [ 557.555260][T12357] ? clear_bhb_loop+0x60/0xb0 [ 557.555280][T12357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.555295][T12357] RIP: 0033:0x7f285258e969 [ 557.555308][T12357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 557.555322][T12357] RSP: 002b:00007f2853435038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 557.555337][T12357] RAX: ffffffffffffffda RBX: 00007f28527b5fa0 RCX: 00007f285258e969 [ 557.555349][T12357] RDX: 0000000000000030 RSI: 0000000000000000 RDI: 0000000000000003 [ 557.555358][T12357] RBP: 00007f2853435090 R08: 0000000000000290 R09: 0000000000000000 [ 557.555368][T12357] R10: 0000200000000800 R11: 0000000000000246 R12: 0000000000000001 [ 557.555378][T12357] R13: 0000000000000000 R14: 00007f28527b5fa0 R15: 00007f28528dfa28 [ 557.555401][T12357] [ 557.773311][ C0] vkms_vblank_simulate: vblank timer overrun [ 557.985580][T12322] usb 6-1: new full-speed USB device number 72 using dummy_hcd [ 558.205705][T12322] usb 6-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 558.215045][T12322] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.226097][T12322] usb 6-1: Product: syz [ 558.240462][T12322] usb 6-1: Manufacturer: syz [ 558.273568][T12322] usb 6-1: SerialNumber: syz [ 558.304795][T12322] usb 6-1: config 0 descriptor?? [ 558.341616][T12322] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 558.408072][T12322] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 558.520815][T12322] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-19) [ 558.717093][T12309] gspca_main: spca501-2.14.0 probing 0000:0000 [ 558.729835][T12309] gspca_spca501: reg write: error -71 [ 558.854630][T12309] spca501 4-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 558.882077][T12309] spca501 4-1:1.0: probe with driver spca501 failed with error -22 [ 558.985382][T12309] usb 4-1: USB disconnect, device number 82 [ 559.121275][ T6011] udevd[6011]: setting mode of /dev/bus/usb/004/082 to 020664 failed: No such file or directory [ 559.147625][ T6011] udevd[6011]: setting owner of /dev/bus/usb/004/082 to uid=0, gid=0 failed: No such file or directory [ 559.785659][T12309] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 560.037346][T12309] usb 4-1: Using ep0 maxpacket: 32 [ 560.045406][T12309] usb 4-1: unable to get BOS descriptor or descriptor too short [ 560.054508][T12309] usb 4-1: config 244 has an invalid interface number: 68 but max is 0 [ 560.062964][T12309] usb 4-1: config 244 has no interface number 0 [ 560.071222][T12309] usb 4-1: config 244 interface 68 altsetting 3 has an endpoint descriptor with address 0xF8, changing to 0x88 [ 560.083174][T12309] usb 4-1: config 244 interface 68 altsetting 3 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 560.094630][T12309] usb 4-1: config 244 interface 68 altsetting 3 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 560.263139][T12309] usb 4-1: config 244 interface 68 altsetting 3 endpoint 0xA has invalid wMaxPacketSize 0 [ 560.279666][ T5830] usb 6-1: USB disconnect, device number 72 [ 560.294600][T12387] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1607'. [ 560.375739][T12309] usb 4-1: config 244 interface 68 has no altsetting 0 [ 560.414952][T12309] usb 4-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=24.0f [ 560.425349][T12309] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.438237][T12309] usb 4-1: Product: syz [ 560.442549][T12309] usb 4-1: Manufacturer: syz [ 560.449730][T12309] usb 4-1: SerialNumber: syz [ 560.966163][ T5830] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 561.081984][T12398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.091499][T12398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.350438][ T5830] usb 1-1: config 0 has no interfaces? [ 561.391252][ T5830] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 561.412006][ T5830] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.569796][ T5830] usb 1-1: Product: syz [ 561.574128][ T5830] usb 1-1: Manufacturer: syz [ 561.598041][ T5830] usb 1-1: SerialNumber: syz [ 561.623237][ T5830] usb 1-1: config 0 descriptor?? [ 561.965855][ T5830] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 562.130285][T12406] FAULT_INJECTION: forcing a failure. [ 562.130285][T12406] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 562.146851][ T5830] usb 6-1: Using ep0 maxpacket: 16 [ 562.162510][ T5830] usb 6-1: config 0 has an invalid interface number: 18 but max is 0 [ 562.196952][ T5830] usb 6-1: config 0 has no interface number 0 [ 562.205891][T12406] CPU: 1 UID: 0 PID: 12406 Comm: syz.2.1612 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 562.205922][T12406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 562.205935][T12406] Call Trace: [ 562.205944][T12406] [ 562.205954][T12406] dump_stack_lvl+0x189/0x250 [ 562.206002][T12406] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.206032][T12406] ? __pfx__printk+0x10/0x10 [ 562.206055][T12406] ? fs_reclaim_acquire+0x7d/0x100 [ 562.206098][T12406] should_fail_ex+0x414/0x560 [ 562.206127][T12406] prepare_alloc_pages+0x213/0x610 [ 562.206169][T12406] __alloc_frozen_pages_noprof+0x123/0x370 [ 562.206194][T12406] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 562.206226][T12406] ? policy_nodemask+0x27c/0x720 [ 562.206273][T12406] alloc_pages_mpol+0x232/0x4a0 [ 562.206307][T12406] alloc_pages_noprof+0xa9/0x190 [ 562.206337][T12406] pte_alloc_one+0x1e/0x160 [ 562.206363][T12406] __handle_mm_fault+0x27e8/0x5380 [ 562.206390][T12406] ? mt_find+0x15c/0x5f0 [ 562.206434][T12406] ? __pfx___handle_mm_fault+0x10/0x10 [ 562.206479][T12406] ? find_vma+0xe7/0x160 [ 562.206504][T12406] ? __pfx_find_vma+0x10/0x10 [ 562.206536][T12406] handle_mm_fault+0x3f6/0x8c0 [ 562.206573][T12406] do_user_addr_fault+0x764/0x1390 [ 562.206613][T12406] exc_page_fault+0x68/0x110 [ 562.206640][T12406] asm_exc_page_fault+0x26/0x30 [ 562.206660][T12406] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 562.206681][T12406] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 7f f2 03 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 562.206699][T12406] RSP: 0018:ffffc9000448fb40 EFLAGS: 00050206 [ 562.206717][T12406] RAX: 00007ffffffff001 RBX: 0000000000000290 RCX: 0000000000000290 [ 562.206731][T12406] RDX: 0000000000000001 RSI: 0000200000000800 RDI: ffff88807d406000 [ 562.206746][T12406] RBP: 0000000000000000 R08: ffff88807d40628f R09: 1ffff1100fa80c51 [ 562.206760][T12406] R10: dffffc0000000000 R11: ffffed100fa80c52 R12: 1ffff11006744a26 [ 562.206775][T12406] R13: 0000000000020000 R14: ffff88807d406000 R15: 0000200000000800 [ 562.206809][T12406] _copy_from_user+0x7a/0xb0 [ 562.206840][T12406] memdup_sockptr_noprof+0x95/0x100 [ 562.206863][T12406] ip_set_mcast_msfilter+0xcc/0x320 [ 562.206890][T12406] do_ip_setsockopt+0x19e7/0x2d00 [ 562.206913][T12406] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 562.206940][T12406] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 562.206964][T12406] ? aa_sk_perm+0x81e/0x950 [ 562.206997][T12406] ? __pfx_aa_sk_perm+0x10/0x10 [ 562.207029][T12406] ip_setsockopt+0x66/0x110 [ 562.207047][T12406] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 562.207075][T12406] do_sock_setsockopt+0x257/0x3e0 [ 562.207106][T12406] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 562.207131][T12406] ? __fget_files+0x2a/0x420 [ 562.207162][T12406] ? __fget_files+0x3a0/0x420 [ 562.207187][T12406] ? __fget_files+0x2a/0x420 [ 562.207223][T12406] __x64_sys_setsockopt+0x18b/0x220 [ 562.207258][T12406] do_syscall_64+0xf6/0x210 [ 562.207284][T12406] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 562.207305][T12406] ? clear_bhb_loop+0x60/0xb0 [ 562.207329][T12406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.207349][T12406] RIP: 0033:0x7f285258e969 [ 562.207366][T12406] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.207383][T12406] RSP: 002b:00007f2853435038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 562.207403][T12406] RAX: ffffffffffffffda RBX: 00007f28527b5fa0 RCX: 00007f285258e969 [ 562.207418][T12406] RDX: 0000000000000030 RSI: 0000000000000000 RDI: 0000000000000003 [ 562.207430][T12406] RBP: 00007f2853435090 R08: 0000000000000290 R09: 0000000000000000 [ 562.207443][T12406] R10: 0000200000000800 R11: 0000000000000246 R12: 0000000000000001 [ 562.207456][T12406] R13: 0000000000000000 R14: 00007f28527b5fa0 R15: 00007f28528dfa28 [ 562.207489][T12406] [ 562.776047][ T5830] usb 6-1: config 0 interface 18 has no altsetting 0 [ 562.791374][ T5830] usb 6-1: New USB device found, idVendor=0830, idProduct=0040, bcdDevice= 9.70 [ 562.800500][ T5830] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.809075][ T5830] usb 6-1: Product: syz [ 562.813356][ T5830] usb 6-1: Manufacturer: syz [ 562.818026][ T5830] usb 6-1: SerialNumber: syz [ 562.826018][ T5830] usb 6-1: config 0 descriptor?? [ 562.902102][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.908588][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.092283][T12309] comedi comedi0: Endpoint has wrong direction [ 563.125927][T12309] dt9812 4-1:244.68: driver 'dt9812' failed to auto-configure device. [ 563.179524][T12309] usb 4-1: USB disconnect, device number 83 [ 563.375030][T12413] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1615'. [ 563.495614][T12306] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 563.571033][ T5830] usb 6-1: active config #0 != 1 ?? [ 563.622906][ T5830] usb 6-1: USB disconnect, device number 73 [ 563.660107][T12306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 563.834684][T12306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 563.894183][T12422] loop8: detected capacity change from 0 to 7 [ 563.903297][T12422] Dev loop8: unable to read RDB block 7 [ 563.913312][T12306] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 563.915825][T12422] loop8: AHDI p3 [ 564.010542][T12422] loop8: partition table partially beyond EOD, truncated [ 564.133349][T12306] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 564.137501][T12422] Dev loop8: unable to read RDB block 7 [ 564.157294][T12306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.186830][T12422] loop8: AHDI p3 [ 564.188530][T12309] usb 1-1: USB disconnect, device number 114 [ 564.190861][T12422] loop8: partition table partially beyond EOD, truncated [ 564.223842][T12306] usb 3-1: config 0 descriptor?? [ 564.663355][T12306] plantronics 0003:047F:FFFF.001A: No inputs registered, leaving [ 564.677262][T12306] plantronics 0003:047F:FFFF.001A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 564.755646][T12316] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 564.938380][T12316] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 564.946451][T12316] usb 6-1: can't read configurations, error -61 [ 565.005240][T12314] usb 3-1: USB disconnect, device number 93 [ 565.242898][T12316] usb 6-1: new full-speed USB device number 75 using dummy_hcd [ 565.448973][T12316] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 565.470356][T12316] usb 6-1: can't read configurations, error -61 [ 565.496037][T12316] usb usb6-port1: attempt power cycle [ 565.525984][ T5830] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 565.638715][T12440] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1623'. [ 565.675576][ T5830] usb 2-1: Using ep0 maxpacket: 32 [ 565.682876][ T5830] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 565.692388][ T5830] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 565.704233][ T5830] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 565.716584][ T5830] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 565.730915][ T5830] usb 2-1: config 0 interface 0 has no altsetting 0 [ 565.741350][ T5830] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 565.761415][ T5830] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 565.784759][ T5830] usb 2-1: Product: syz [ 565.801716][ T5830] usb 2-1: Manufacturer: syz [ 565.812089][ T5830] usb 2-1: SerialNumber: syz [ 565.836823][ T5830] usb 2-1: config 0 descriptor?? [ 565.852140][ T5830] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 565.862082][T12316] usb 6-1: new full-speed USB device number 76 using dummy_hcd [ 565.874937][ T5830] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 565.889420][T12316] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 565.897544][T12314] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 565.900902][T12442] FAULT_INJECTION: forcing a failure. [ 565.900902][T12442] name failslab, interval 1, probability 0, space 0, times 0 [ 565.914729][T12316] usb 6-1: can't read configurations, error -61 [ 565.927761][T12442] CPU: 0 UID: 0 PID: 12442 Comm: syz.3.1624 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 565.927788][T12442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 565.927801][T12442] Call Trace: [ 565.927810][T12442] [ 565.927819][T12442] dump_stack_lvl+0x189/0x250 [ 565.927857][T12442] ? __pfx_dump_stack_lvl+0x10/0x10 [ 565.927887][T12442] ? __pfx__printk+0x10/0x10 [ 565.927914][T12442] ? __pfx___might_resched+0x10/0x10 [ 565.927933][T12442] ? fs_reclaim_acquire+0x7d/0x100 [ 565.927977][T12442] should_fail_ex+0x414/0x560 [ 565.928005][T12442] should_failslab+0xa8/0x100 [ 565.928034][T12442] kmem_cache_alloc_noprof+0x73/0x3c0 [ 565.928059][T12442] ? ptlock_alloc+0x20/0x70 [ 565.928090][T12442] ptlock_alloc+0x20/0x70 [ 565.928116][T12442] pte_alloc_one+0x6d/0x160 [ 565.928142][T12442] __handle_mm_fault+0x27e8/0x5380 [ 565.928167][T12442] ? mt_find+0x15c/0x5f0 [ 565.928211][T12442] ? __pfx___handle_mm_fault+0x10/0x10 [ 565.928255][T12442] ? find_vma+0xe7/0x160 [ 565.928280][T12442] ? __pfx_find_vma+0x10/0x10 [ 565.928310][T12442] handle_mm_fault+0x3f6/0x8c0 [ 565.928346][T12442] do_user_addr_fault+0x764/0x1390 [ 565.928385][T12442] exc_page_fault+0x68/0x110 [ 565.928407][T12442] ? __might_fault+0xb0/0x130 [ 565.928435][T12442] asm_exc_page_fault+0x26/0x30 [ 565.928454][T12442] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 565.928475][T12442] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 7f f2 03 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 565.928492][T12442] RSP: 0018:ffffc9000434fb40 EFLAGS: 00050206 [ 565.928511][T12442] RAX: 00007ffffffff001 RBX: 0000000000000290 RCX: 0000000000000290 [ 565.928525][T12442] RDX: 0000000000000001 RSI: 0000200000000800 RDI: ffff88805c616000 [ 565.928539][T12442] RBP: 0000000000000000 R08: ffff88805c61628f R09: 1ffff1100b8c2c51 [ 565.928553][T12442] R10: dffffc0000000000 R11: ffffed100b8c2c52 R12: 1ffff1100674479e [ 565.928568][T12442] R13: 0000000000020000 R14: ffff88805c616000 R15: 0000200000000800 [ 565.928601][T12442] _copy_from_user+0x7a/0xb0 [ 565.928631][T12442] memdup_sockptr_noprof+0x95/0x100 [ 565.928653][T12442] ip_set_mcast_msfilter+0xcc/0x320 [ 565.928680][T12442] do_ip_setsockopt+0x19e7/0x2d00 [ 565.928701][T12442] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 565.928722][T12442] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 565.928746][T12442] ? aa_sk_perm+0x81e/0x950 [ 565.928773][T12442] ? __pfx_aa_sk_perm+0x10/0x10 [ 565.928806][T12442] ip_setsockopt+0x66/0x110 [ 565.928824][T12442] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 565.928851][T12442] do_sock_setsockopt+0x257/0x3e0 [ 565.928886][T12442] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 565.928910][T12442] ? __fget_files+0x2a/0x420 [ 565.928957][T12442] ? __fget_files+0x3a0/0x420 [ 565.928983][T12442] ? __fget_files+0x2a/0x420 [ 565.929019][T12442] __x64_sys_setsockopt+0x18b/0x220 [ 565.929054][T12442] do_syscall_64+0xf6/0x210 [ 565.929081][T12442] ? clear_bhb_loop+0x60/0xb0 [ 565.929106][T12442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.929126][T12442] RIP: 0033:0x7f374e58e969 [ 565.929144][T12442] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 565.929161][T12442] RSP: 002b:00007f374f36b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 565.929181][T12442] RAX: ffffffffffffffda RBX: 00007f374e7b5fa0 RCX: 00007f374e58e969 [ 565.929195][T12442] RDX: 0000000000000030 RSI: 0000000000000000 RDI: 0000000000000003 [ 565.929207][T12442] RBP: 00007f374f36b090 R08: 0000000000000290 R09: 0000000000000000 [ 565.929221][T12442] R10: 0000200000000800 R11: 0000000000000246 R12: 0000000000000001 [ 565.929233][T12442] R13: 0000000000000000 R14: 00007f374e7b5fa0 R15: 00007f374e8dfa28 [ 565.929266][T12442] [ 566.056235][T12316] usb 6-1: new full-speed USB device number 77 using dummy_hcd [ 566.320837][T12314] usb 1-1: Using ep0 maxpacket: 32 [ 566.328784][T12314] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 566.342509][T12314] usb 1-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=93.a8 [ 566.351732][T12314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.361338][T12314] usb 1-1: Product: syz [ 566.367831][T12314] usb 1-1: Manufacturer: syz [ 566.373124][T12314] usb 1-1: SerialNumber: syz [ 566.416435][T12316] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 566.425995][T12316] usb 6-1: can't read configurations, error -61 [ 566.452144][T12316] usb usb6-port1: unable to enumerate USB device [ 566.469978][T12314] usb 1-1: config 0 descriptor?? [ 566.675536][T12313] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 566.706023][T12314] ath6kl: Failed to submit usb control message: -71 [ 566.726137][T12314] ath6kl: unable to send the bmi data to the device: -71 [ 566.749329][T12314] ath6kl: Unable to send get target info: -71 [ 566.767419][T12314] ath6kl: Failed to init ath6kl core: -71 [ 566.774395][T12314] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 566.792361][T12314] usb 1-1: USB disconnect, device number 115 [ 566.876932][T12313] usb 4-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 566.888086][T12313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.901167][T12313] usb 4-1: Product: syz [ 566.905368][T12313] usb 4-1: Manufacturer: syz [ 566.910898][T12313] usb 4-1: SerialNumber: syz [ 566.926785][T12313] usb 4-1: config 0 descriptor?? [ 566.935205][T12313] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 566.953047][T12313] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 566.981990][T12313] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-19) [ 567.250471][T12314] usb 2-1: USB disconnect, device number 104 [ 567.292281][T12314] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 567.362411][T12306] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 567.427070][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 567.427090][ T30] audit: type=1326 audit(1748082202.831:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 567.505965][T12458] xt_socket: unknown flags 0x8 [ 567.571091][T12306] usb 3-1: unable to get BOS descriptor or descriptor too short [ 567.596525][T12306] usb 3-1: not running at top speed; connect to a high speed hub [ 567.702089][T12306] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 567.712259][ T30] audit: type=1326 audit(1748082202.931:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 567.735350][T12306] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 22619, setting to 1023 [ 567.786414][T12306] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 567.799286][T12306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.830539][T12306] usb 3-1: Product: syz [ 567.850971][ T30] audit: type=1326 audit(1748082202.991:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 567.898125][T12306] usb 3-1: Manufacturer: syz [ 567.917593][T12306] usb 3-1: SerialNumber: syz [ 567.936552][T12314] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 567.962992][ T30] audit: type=1326 audit(1748082203.171:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 568.002038][ T30] audit: type=1326 audit(1748082203.261:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 568.063045][ T30] audit: type=1326 audit(1748082203.351:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 568.110527][ T30] audit: type=1326 audit(1748082203.471:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 568.227518][T12306] usb 3-1: 2:1: cannot set freq 4656509 to ep 0x82 [ 568.234690][ T30] audit: type=1326 audit(1748082203.541:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12457 comm="syz.0.1628" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfbbf8e969 code=0x0 [ 568.324737][T12314] usb 6-1: config 0 has no interfaces? [ 568.393904][T12314] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 568.412357][T12306] usb 3-1: USB disconnect, device number 94 [ 568.453707][T12314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.500792][T12314] usb 6-1: Product: syz [ 568.531362][T12314] usb 6-1: Manufacturer: syz [ 568.549535][T12314] usb 6-1: SerialNumber: syz [ 568.585370][T12314] usb 6-1: config 0 descriptor?? [ 568.910833][ T5924] udevd[5924]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 570.301371][T12313] usb 4-1: USB disconnect, device number 84 [ 570.775571][T12313] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 570.933407][T12306] usb 6-1: USB disconnect, device number 78 [ 571.016340][T12313] usb 4-1: Using ep0 maxpacket: 16 [ 571.070900][T12313] usb 4-1: no configurations [ 571.092970][T12313] usb 4-1: can't read configurations, error -22 [ 571.255611][T12313] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 571.405531][T12306] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 571.406137][T12313] usb 4-1: Using ep0 maxpacket: 16 [ 571.460824][T12313] usb 4-1: no configurations [ 571.465972][T12313] usb 4-1: can't read configurations, error -22 [ 571.484295][T12313] usb usb4-port1: attempt power cycle [ 571.578498][T12306] usb 6-1: Using ep0 maxpacket: 32 [ 571.587582][T12306] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 571.599965][T12306] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.615860][T12306] usb 6-1: Product: syz [ 571.620130][T12306] usb 6-1: Manufacturer: syz [ 571.629404][T12306] usb 6-1: SerialNumber: syz [ 571.653795][T12306] usb 6-1: config 0 descriptor?? [ 571.683133][T12306] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 571.689993][T12309] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 571.835609][T12313] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 571.855915][T12309] usb 3-1: Using ep0 maxpacket: 8 [ 571.866880][T12313] usb 4-1: Using ep0 maxpacket: 16 [ 571.872877][T12313] usb 4-1: no configurations [ 571.877950][T12313] usb 4-1: can't read configurations, error -22 [ 571.895160][T12309] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 571.910847][T12306] gspca_stk1135: reg_w 0x2 err -71 [ 571.938302][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 571.956610][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 571.963006][T12306] gspca_stk1135: Sensor write failed [ 571.979366][T12309] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 571.996137][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.006083][T12313] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 572.013791][T12306] gspca_stk1135: Sensor write failed [ 572.019741][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 572.031071][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.040633][T12313] usb 4-1: Using ep0 maxpacket: 16 [ 572.043378][T12306] gspca_stk1135: Sensor read failed [ 572.053039][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 572.062421][T12313] usb 4-1: no configurations [ 572.064791][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.070164][T12313] usb 4-1: can't read configurations, error -22 [ 572.078765][T12516] dummy0: mtu less than device minimum [ 572.088902][T12306] gspca_stk1135: Sensor read failed [ 572.096098][T12313] usb usb4-port1: unable to enumerate USB device [ 572.106505][T12309] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 572.119290][T12306] gspca_stk1135: Detected sensor type unknown (0x0) [ 572.128132][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 572.140627][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.148099][T12309] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 572.166021][T12306] gspca_stk1135: Sensor read failed [ 572.174733][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.181748][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 572.193387][T12306] gspca_stk1135: Sensor read failed [ 572.202227][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.209220][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 572.221107][T12306] gspca_stk1135: Sensor write failed [ 572.227883][T12306] gspca_stk1135: serial bus timeout: status=0x00 [ 572.234539][T12306] gspca_stk1135: Sensor write failed [ 572.241507][T12309] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 572.249606][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 572.261459][T12306] stk1135 6-1:0.0: probe with driver stk1135 failed with error -71 [ 572.272373][T12309] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 572.285949][T12306] usb 6-1: USB disconnect, device number 79 [ 572.306058][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 572.344859][T12309] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 572.365932][T12309] usb 3-1: string descriptor 0 read error: -22 [ 572.372454][T12309] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 572.385876][T12309] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.414161][T12309] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 573.158127][T12309] usb 3-1: USB disconnect, device number 95 [ 573.388264][T12528] netlink: 9 bytes leftover after parsing attributes in process `syz.5.1646'. [ 573.405389][T12528] 1ªX¹¦D: entered promiscuous mode [ 573.420571][T12528] 1ªX¹¦D: left allmulticast mode [ 573.460319][T12528] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1646'. [ 573.517104][T12528] 0ªX¹¦D: renamed from 31ªX¹¦D [ 573.538186][T12528] 0ªX¹¦D: left promiscuous mode [ 573.543205][T12528] 0ªX¹¦D: entered allmulticast mode [ 573.556919][T12528] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 573.665293][T12528] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 573.687698][T12527] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 573.885938][T12313] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 573.986049][T12314] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 574.035942][T12313] usb 4-1: Using ep0 maxpacket: 32 [ 574.048176][T12313] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 574.057846][T12313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.070873][T12313] usb 4-1: Product: syz [ 574.075056][T12313] usb 4-1: Manufacturer: syz [ 574.079969][T12313] usb 4-1: SerialNumber: syz [ 574.087674][T12313] usb 4-1: config 0 descriptor?? [ 574.099115][T12313] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 574.145843][T12314] usb 1-1: Using ep0 maxpacket: 32 [ 574.153143][T12314] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 574.161809][T12314] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 574.171192][T12314] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 574.181730][T12314] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 574.191439][T12314] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 574.200707][T12314] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.303321][T12313] gspca_stk1135: reg_w 0x2 err -71 [ 574.305829][T12306] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 574.310094][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.323125][T12313] gspca_stk1135: Sensor write failed [ 574.335054][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.341546][T12313] gspca_stk1135: Sensor write failed [ 574.347384][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.353743][T12313] gspca_stk1135: Sensor read failed [ 574.359200][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.366016][T12313] gspca_stk1135: Sensor read failed [ 574.371500][T12313] gspca_stk1135: Detected sensor type unknown (0x0) [ 574.378470][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.384963][T12313] gspca_stk1135: Sensor read failed [ 574.390781][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.397336][T12313] gspca_stk1135: Sensor read failed [ 574.402589][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.409636][T12313] gspca_stk1135: Sensor write failed [ 574.415007][T12313] gspca_stk1135: serial bus timeout: status=0x00 [ 574.435499][T12313] gspca_stk1135: Sensor write failed [ 574.440948][T12313] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 574.484004][T12313] usb 4-1: USB disconnect, device number 89 [ 574.509793][T12306] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 574.527169][T12306] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 574.542010][T12306] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 574.570825][T12306] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.603194][T12306] usb 6-1: config 0 descriptor?? [ 574.628973][T12306] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 576.266339][T12306] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 576.427260][T12306] usb 4-1: config 0 has an invalid interface number: 207 but max is 0 [ 576.440063][T12306] usb 4-1: config 0 has no interface number 0 [ 576.449523][T12306] usb 4-1: New USB device found, idVendor=12d1, idProduct=ed56, bcdDevice=46.dd [ 576.463320][T12306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.473702][T12306] usb 4-1: Product: syz [ 576.481369][T12306] usb 4-1: Manufacturer: syz [ 576.487288][T12306] usb 4-1: SerialNumber: syz [ 576.499387][T12306] usb 4-1: config 0 descriptor?? [ 576.519439][T12306] qmi_wwan 4-1:0.207: bogus CDC Union: master=0, slave=1 [ 576.693539][T12539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 576.705868][T12314] usb 1-1: USB disconnect, device number 116 [ 576.742529][T12306] qmi_wwan 4-1:0.207: probe with driver qmi_wwan failed with error -22 [ 576.919485][T12575] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1659'. [ 577.113026][T12314] usb 6-1: USB disconnect, device number 81 [ 577.143526][T12580] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 577.396218][T12309] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 577.427797][T12585] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1663'. [ 577.437612][T12585] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1663'. [ 577.565593][T12309] usb 3-1: Using ep0 maxpacket: 8 [ 577.572842][T12309] usb 3-1: config 127 has an invalid interface number: 106 but max is 0 [ 577.581558][T12309] usb 3-1: config 127 contains an unexpected descriptor of type 0x1, skipping [ 577.600457][T12309] usb 3-1: config 127 has an invalid interface number: 156 but max is 0 [ 577.638708][T12309] usb 3-1: config 127 contains an unexpected descriptor of type 0x2, skipping [ 577.651049][T12601] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1665'. [ 577.675293][T12309] usb 3-1: config 127 has 2 interfaces, different from the descriptor's value: 1 [ 577.690413][T12309] usb 3-1: config 127 has no interface number 0 [ 577.696852][T12309] usb 3-1: config 127 has no interface number 1 [ 577.703342][T12309] usb 3-1: config 127 interface 106 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 577.723381][T12309] usb 3-1: config 127 interface 106 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 577.735083][T12601] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1665'. [ 577.749640][T12309] usb 3-1: config 127 interface 106 altsetting 2 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 577.761166][T12309] usb 3-1: config 127 interface 106 altsetting 2 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 577.788614][T12309] usb 3-1: config 127 interface 106 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 577.828894][T12309] usb 3-1: config 127 interface 106 altsetting 2 has 7 endpoint descriptors, different from the interface descriptor's value: 15 [ 577.873003][T12309] usb 3-1: too many endpoints for config 127 interface 156 altsetting 201: 50, using maximum allowed: 30 [ 577.901308][T12309] usb 3-1: config 127 interface 156 altsetting 201 has a duplicate endpoint with address 0x3, skipping [ 578.013545][T12309] usb 3-1: config 127 interface 156 altsetting 201 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 578.115540][T12309] usb 3-1: config 127 interface 156 altsetting 201 endpoint 0xD has an invalid bInterval 145, changing to 7 [ 578.223615][T12309] usb 3-1: config 127 interface 156 altsetting 201 has a duplicate endpoint with address 0x6, skipping [ 578.290875][T12309] usb 3-1: config 127 interface 156 altsetting 201 has a duplicate endpoint with address 0x6, skipping [ 578.341939][T12309] usb 3-1: config 127 interface 156 altsetting 201 has 8 endpoint descriptors, different from the interface descriptor's value: 50 [ 578.433026][T12309] usb 3-1: config 127 interface 106 has no altsetting 0 [ 578.466268][T12309] usb 3-1: config 127 interface 156 has no altsetting 0 [ 578.487478][T12309] usb 3-1: New USB device found, idVendor=0403, idProduct=f7c0, bcdDevice=3c.28 [ 578.511105][T12309] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.538935][T12309] usb 3-1: Product: syz [ 578.555584][T12309] usb 3-1: Manufacturer: syz [ 578.594540][T12309] usb 3-1: SerialNumber: syz [ 578.625836][T12316] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 578.806840][T12316] usb 1-1: Using ep0 maxpacket: 16 [ 578.822874][T12316] usb 1-1: unable to get BOS descriptor or descriptor too short [ 578.838308][T12309] ftdi_sio 3-1:127.106: FTDI USB Serial Device converter detected [ 578.862283][T12316] usb 1-1: config 1 interface 0 has no altsetting 0 [ 578.883680][T12316] usb 1-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 578.893656][T12316] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.902047][T12316] usb 1-1: Product: syz [ 578.918250][T12316] usb 1-1: Manufacturer: syz [ 578.934232][T12316] usb 1-1: SerialNumber: syz [ 578.934578][T12309] ftdi_sio ttyUSB0: unknown device type: 0x3c28 [ 579.028591][T12309] ftdi_sio 3-1:127.156: FTDI USB Serial Device converter detected [ 579.074396][T12309] ftdi_sio ttyUSB1: unknown device type: 0x3c28 [ 579.153517][T12309] usb 3-1: USB disconnect, device number 96 [ 579.277534][T12309] ftdi_sio 3-1:127.106: device disconnected [ 579.321901][T12309] ftdi_sio 3-1:127.156: device disconnected [ 579.705142][T12627] wg1: entered promiscuous mode [ 579.758277][T12627] wg1: entered allmulticast mode [ 580.139565][T12631] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1673'. [ 580.256370][T12631] macsec1: entered allmulticast mode [ 580.328331][T12631] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 580.379959][T12631] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 580.664918][T12643] FAULT_INJECTION: forcing a failure. [ 580.664918][T12643] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 580.697139][T12643] CPU: 0 UID: 0 PID: 12643 Comm: syz.2.1675 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 580.697171][T12643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 580.697184][T12643] Call Trace: [ 580.697193][T12643] [ 580.697203][T12643] dump_stack_lvl+0x189/0x250 [ 580.697238][T12643] ? __lock_acquire+0xaac/0xd20 [ 580.697272][T12643] ? __pfx_dump_stack_lvl+0x10/0x10 [ 580.697302][T12643] ? __pfx__printk+0x10/0x10 [ 580.697323][T12643] ? __might_fault+0xb0/0x130 [ 580.697363][T12643] should_fail_ex+0x414/0x560 [ 580.697393][T12643] _copy_from_user+0x2d/0xb0 [ 580.697422][T12643] kstrtouint_from_user+0xc4/0x170 [ 580.697449][T12643] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 580.697493][T12643] proc_fail_nth_write+0x88/0x240 [ 580.697525][T12643] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 580.697560][T12643] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 580.697663][T12643] vfs_write+0x27b/0xa90 [ 580.697696][T12643] ? __pfx_vfs_write+0x10/0x10 [ 580.697719][T12643] ? __fget_files+0x2a/0x420 [ 580.697748][T12643] ? __fget_files+0x3a0/0x420 [ 580.697775][T12643] ? __fget_files+0x2a/0x420 [ 580.697813][T12643] ksys_write+0x145/0x250 [ 580.697835][T12643] ? rcu_is_watching+0x15/0xb0 [ 580.697854][T12643] ? __pfx_ksys_write+0x10/0x10 [ 580.697882][T12643] ? do_syscall_64+0xba/0x210 [ 580.697915][T12643] do_syscall_64+0xf6/0x210 [ 580.697943][T12643] ? clear_bhb_loop+0x60/0xb0 [ 580.697968][T12643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.697989][T12643] RIP: 0033:0x7f285258d41f [ 580.698007][T12643] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 580.698023][T12643] RSP: 002b:00007f28533f3030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 580.698045][T12643] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f285258d41f [ 580.698060][T12643] RDX: 0000000000000001 RSI: 00007f28533f30a0 RDI: 000000000000000a [ 580.698074][T12643] RBP: 00007f28533f3090 R08: 0000000000000000 R09: 0000000000000000 [ 580.698088][T12643] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 580.698100][T12643] R13: 0000000000000001 R14: 00007f28527b6160 R15: 00007f28528dfa28 [ 580.698134][T12643] [ 581.056088][T12314] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 581.068123][T12647] FAULT_INJECTION: forcing a failure. [ 581.068123][T12647] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 581.081999][T12647] CPU: 0 UID: 0 PID: 12647 Comm: syz.5.1677 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 581.082027][T12647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 581.082040][T12647] Call Trace: [ 581.082049][T12647] [ 581.082059][T12647] dump_stack_lvl+0x189/0x250 [ 581.082091][T12647] ? __lock_acquire+0xaac/0xd20 [ 581.082124][T12647] ? __pfx_dump_stack_lvl+0x10/0x10 [ 581.082155][T12647] ? __pfx__printk+0x10/0x10 [ 581.082178][T12647] ? __might_fault+0xb0/0x130 [ 581.082218][T12647] should_fail_ex+0x414/0x560 [ 581.082247][T12647] _copy_from_user+0x2d/0xb0 [ 581.082279][T12647] snd_seq_write+0x300/0x810 [ 581.082319][T12647] ? __pfx_snd_seq_write+0x10/0x10 [ 581.082343][T12647] ? bpf_lsm_file_permission+0x9/0x20 [ 581.082371][T12647] ? security_file_permission+0x75/0x290 [ 581.082407][T12647] ? rw_verify_area+0x258/0x650 [ 581.082431][T12647] ? __pfx_snd_seq_write+0x10/0x10 [ 581.082457][T12647] vfs_write+0x27b/0xa90 [ 581.082492][T12647] ? __pfx_vfs_write+0x10/0x10 [ 581.082519][T12647] ? __fget_files+0x2a/0x420 [ 581.082551][T12647] ? __fget_files+0x2a/0x420 [ 581.082578][T12647] ? __fget_files+0x3a0/0x420 [ 581.082605][T12647] ? __fget_files+0x2a/0x420 [ 581.082643][T12647] ksys_write+0x145/0x250 [ 581.082666][T12647] ? rcu_is_watching+0x15/0xb0 [ 581.082688][T12647] ? __pfx_ksys_write+0x10/0x10 [ 581.082717][T12647] ? do_syscall_64+0xba/0x210 [ 581.082750][T12647] do_syscall_64+0xf6/0x210 [ 581.082779][T12647] ? clear_bhb_loop+0x60/0xb0 [ 581.082806][T12647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.082827][T12647] RIP: 0033:0x7fd6c7b8e969 [ 581.082846][T12647] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 581.082872][T12647] RSP: 002b:00007fd6c8aca038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 581.082895][T12647] RAX: ffffffffffffffda RBX: 00007fd6c7db5fa0 RCX: 00007fd6c7b8e969 [ 581.082911][T12647] RDX: 000000000000001c RSI: 0000200000000240 RDI: 0000000000000003 [ 581.082925][T12647] RBP: 00007fd6c8aca090 R08: 0000000000000000 R09: 0000000000000000 [ 581.082938][T12647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 581.082951][T12647] R13: 0000000000000000 R14: 00007fd6c7db5fa0 R15: 00007fd6c7edfa28 [ 581.082981][T12647] [ 581.652094][T12314] usb 2-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 581.720675][T12316] usbhid 1-1:1.0: can't add hid device: -71 [ 581.730650][T12314] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.752811][T12316] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 581.774879][T12314] usb 2-1: config 0 descriptor?? [ 581.802113][T12316] usb 1-1: USB disconnect, device number 117 [ 581.859453][T12655] xt_socket: unknown flags 0x8 [ 582.024421][T12314] asix 2-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 582.057950][T12652] mac80211_hwsim hwsim16 è: renamed from wlan1 [ 582.283126][T12314] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 582.302906][T12314] asix 2-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 582.332988][T12314] asix 2-1:0.0: probe with driver asix failed with error -71 [ 582.381129][T12314] usb 2-1: USB disconnect, device number 105 [ 582.993811][T12680] binder: 12679:12680 ioctl c0306201 0 returned -14 [ 583.203005][T12682] xt_CT: You must specify a L4 protocol and not use inversions on it [ 583.442738][T12688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.649168][T12688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 584.144653][T12702] loop8: detected capacity change from 0 to 7 [ 584.153398][T12702] Dev loop8: unable to read RDB block 7 [ 584.167193][T12702] loop8: AHDI p1 p2 p3 [ 584.171542][T12702] loop8: partition table partially beyond EOD, truncated [ 584.182497][T12702] loop8: p1 start 1601398130 is beyond EOD, truncated [ 584.191488][T12702] loop8: p2 start 1702059890 is beyond EOD, truncated [ 584.497749][T12712] B: renamed from veth0 [ 584.520508][T12711] xt_socket: unknown flags 0x8 [ 584.797150][T12720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 584.819844][T12720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.015546][T12314] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 585.178818][T12314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 585.215612][T12314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 585.233352][T12314] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 585.246819][T12314] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 585.256909][T12314] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.270977][T12314] usb 6-1: config 0 descriptor?? [ 585.447352][T12743] loop8: detected capacity change from 0 to 7 [ 585.477815][T12743] Dev loop8: unable to read RDB block 7 [ 585.483488][T12743] loop8: AHDI p1 p2 p3 [ 585.502083][T12743] loop8: partition table partially beyond EOD, truncated [ 585.518820][T12743] loop8: p1 start 1601398130 is beyond EOD, truncated [ 585.530856][T12743] loop8: p2 start 1702059890 is beyond EOD, truncated [ 585.789088][T12755] fuse: Unknown parameter '0xffffffffffffffff017777777777777777777770000000000000000000000000000000000000000' [ 585.811638][T12314] plantronics 0003:047F:FFFF.001B: No inputs registered, leaving [ 585.826875][T12755] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1705'. [ 585.841199][T12755] fuse: Bad value for 'fd' [ 585.890387][T12314] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 585.918850][T12723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.944008][T12723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 586.047578][T12314] usb 6-1: USB disconnect, device number 82 [ 586.108963][T12758] fido_id[12758]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 586.906202][T12769] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 586.942708][T12769] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 586.976216][T12775] xt_socket: unknown flags 0x8 [ 586.982631][T12771] libceph: resolve '0.0' (ret=-3): failed [ 588.540248][T12799] loop8: detected capacity change from 0 to 7 [ 588.556714][T12799] Dev loop8: unable to read RDB block 7 [ 588.565357][T12799] loop8: AHDI p1 p2 p3 [ 588.616610][T12799] loop8: partition table partially beyond EOD, truncated [ 588.623981][T12799] loop8: p1 start 1601398130 is beyond EOD, truncated [ 588.745558][ T5830] usb 2-1: new full-speed USB device number 106 using dummy_hcd [ 588.776304][T12799] loop8: p2 start 1702059890 is beyond EOD, truncated [ 588.842208][ T30] audit: type=1326 audit(1748082224.241:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.5.1719" exe="/root/syz-executor" sig=9 arch=c000003e syscall=157 compat=0 ip=0x7fd6c7b8e969 code=0x0 [ 588.949283][ T5830] usb 2-1: not running at top speed; connect to a high speed hub [ 589.000778][ T5830] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 589.027978][ T5830] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 589.088955][ T5830] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 589.124981][ T5830] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 589.140742][ T5830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.205475][ T5830] usb 2-1: Product: syz [ 589.209696][ T5830] usb 2-1: Manufacturer: syz [ 589.214321][ T5830] usb 2-1: SerialNumber: syz [ 589.336773][T12812] netlink: 'syz.5.1721': attribute type 1 has an invalid length. [ 589.498477][T12787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.541349][T12787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.580565][ T5830] usb 2-1: 0:2 : does not exist [ 589.646466][T12314] IPVS: starting estimator thread 0... [ 589.701310][ T5830] usb 2-1: USB disconnect, device number 106 [ 589.770469][ T6034] udevd[6034]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 589.799190][T12823] IPVS: using max 38 ests per chain, 91200 per kthread [ 590.645571][T12836] sch_fq: defrate 0 ignored. [ 590.702454][ T30] audit: type=1326 audit(1748082226.101:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 590.778809][ T30] audit: type=1326 audit(1748082226.101:330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 590.908151][ T30] audit: type=1326 audit(1748082226.101:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.026021][ T30] audit: type=1326 audit(1748082226.101:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.048943][ T30] audit: type=1326 audit(1748082226.101:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.071754][ T30] audit: type=1326 audit(1748082226.101:334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.151661][ T30] audit: type=1326 audit(1748082226.101:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.231120][ T30] audit: type=1326 audit(1748082226.101:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.288453][ T30] audit: type=1326 audit(1748082226.101:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12835 comm="syz.1.1729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 591.675539][T12316] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 591.855534][T12316] usb 3-1: Using ep0 maxpacket: 8 [ 591.871568][T12316] usb 3-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice=d0.ab [ 591.881256][T12316] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.902334][T12852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.917097][T12316] usb 3-1: Product: syz [ 591.925943][T12316] usb 3-1: Manufacturer: syz [ 591.930592][T12316] usb 3-1: SerialNumber: syz [ 591.950301][T12852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.959537][T12316] usb 3-1: config 0 descriptor?? [ 592.008385][T12852] sctp: [Deprecated]: syz.3.1733 (pid 12852) Use of struct sctp_assoc_value in delayed_ack socket option. [ 592.008385][T12852] Use struct sctp_sack_info instead [ 592.271535][T12316] usb 3-1: USB disconnect, device number 97 [ 592.300446][ T6034] udevd[6034]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 593.050396][T12877] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1743'. [ 593.060169][ T976] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 593.081110][T12876] pim6reg: entered allmulticast mode [ 593.149046][T12875] pim6reg: left allmulticast mode [ 593.156209][T12309] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 593.195345][T12880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 593.215208][T12880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 593.242084][T12880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 593.252145][ T976] usb 2-1: Using ep0 maxpacket: 16 [ 593.259957][ T976] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 593.276687][ T976] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 593.298871][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 152, changing to 11 [ 593.315756][T12880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 593.342923][T12309] usb 1-1: config 0 has no interfaces? [ 593.388178][T12309] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 593.397458][T12309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.460735][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 8285, setting to 1024 [ 593.475078][T12309] usb 1-1: Product: syz [ 593.488454][T12309] usb 1-1: Manufacturer: syz [ 593.544643][ T976] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 593.565464][T12309] usb 1-1: SerialNumber: syz [ 593.596507][T12309] usb 1-1: config 0 descriptor?? [ 593.649290][ T976] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 593.660458][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.683777][ T976] usb 2-1: Product: syz [ 593.689776][ T976] usb 2-1: Manufacturer: syz [ 593.710121][ T976] usb 2-1: SerialNumber: syz [ 593.737818][ T976] usb 2-1: config 0 descriptor?? [ 593.956035][T12871] qrtr: Invalid version 48 [ 593.987501][T12871] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 594.015201][ T976] appledisplay 2-1:0.0: Error while getting initial brightness: -110 [ 594.052629][ T976] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -110 [ 594.089322][ T976] usb 2-1: USB disconnect, device number 107 [ 594.185072][T12892] fuse: Bad value for 'user_id' [ 594.229027][T12892] fuse: Bad value for 'user_id' [ 594.313033][T12895] gtp0: entered promiscuous mode [ 594.318484][T12895] gtp0: entered allmulticast mode [ 595.075907][T12316] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 595.340373][T12316] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 595.383762][T12316] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.412202][T12316] usb 2-1: Product: syz [ 595.434029][T12316] usb 2-1: Manufacturer: syz [ 595.548566][T12316] usb 2-1: SerialNumber: syz [ 595.573358][T12316] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 595.617635][T12314] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 595.976573][ T976] usb 1-1: USB disconnect, device number 118 [ 596.729921][T12314] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 596.755789][T12314] ath9k_htc: Failed to initialize the device [ 597.004340][T12314] usb 2-1: ath9k_htc: USB layer deinitialized [ 597.349970][T12314] usb 2-1: USB disconnect, device number 108 [ 597.973559][T12946] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 598.858681][T12964] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1765'. [ 598.868153][T12314] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 598.882583][T12964] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1765'. [ 598.956888][T12316] usb 2-1: new full-speed USB device number 109 using dummy_hcd [ 599.040266][T12314] usb 6-1: config 0 has no interfaces? [ 599.051415][T12314] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 599.069736][T12314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.085639][T12314] usb 6-1: Product: syz [ 599.094160][T12314] usb 6-1: Manufacturer: syz [ 599.109386][T12314] usb 6-1: SerialNumber: syz [ 599.130587][T12967] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1766'. [ 599.131582][T12314] usb 6-1: config 0 descriptor?? [ 599.157374][T12316] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 599.176853][T12316] usb 2-1: config 0 interface 0 has no altsetting 0 [ 599.193041][T12316] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 599.222905][T12316] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.243538][T12967] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1766'. [ 599.269457][T12316] usb 2-1: config 0 descriptor?? [ 599.279354][T12960] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 599.305550][ T976] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 599.331936][T12967] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1766'. [ 599.457570][ T976] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 599.467782][ T976] usb 1-1: config 0 interface 0 has no altsetting 0 [ 599.477888][ T976] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 599.487327][ T976] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 599.495601][ T976] usb 1-1: Product: syz [ 599.499837][ T976] usb 1-1: Manufacturer: syz [ 599.504430][ T976] usb 1-1: SerialNumber: syz [ 599.513026][ T976] usb 1-1: config 0 descriptor?? [ 599.530725][ T976] usb 1-1: selecting invalid altsetting 0 [ 599.657961][T12309] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 599.709564][T12316] usbhid 2-1:0.0: can't add hid device: -71 [ 599.721251][T12316] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 599.748560][T12965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 599.752067][T12316] usb 2-1: USB disconnect, device number 109 [ 599.773553][T12965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.802554][T12965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 599.818534][T12309] usb 3-1: Using ep0 maxpacket: 32 [ 599.833154][T12309] usb 3-1: config index 0 descriptor too short (expected 8978, got 18) [ 599.836406][T12965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.852490][T12309] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 599.927749][T12309] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 599.949196][T12309] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.967205][T12309] usb 3-1: Product: syz [ 599.973781][T12309] usb 3-1: Manufacturer: syz [ 599.984170][T12309] usb 3-1: SerialNumber: syz [ 600.023028][T12309] usb 3-1: config 0 descriptor?? [ 600.089428][T12976] batadv_slave_0: entered promiscuous mode [ 600.106032][T12976] batadv_slave_0: entered allmulticast mode [ 600.391523][T12309] usb 1-1: USB disconnect, device number 119 [ 600.604985][T12983] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1769'. [ 600.615260][T12983] 1ªX¹¦D: left allmulticast mode [ 600.667260][T12984] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1769'. [ 600.683241][T12984] 0ªX¹¦D: renamed from 31ªX¹¦D [ 600.723444][T12984] 0ªX¹¦D: left promiscuous mode [ 600.735978][T12984] 0ªX¹¦D: entered allmulticast mode [ 600.777179][T12984] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 600.811447][T12970] loop6: detected capacity change from 0 to 63 [ 600.959078][T12983] bond0: (slave bridge0): Releasing backup interface [ 601.109742][T12989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1770'. [ 601.122973][T12984] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 601.161921][T12982] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 601.645635][T12309] usb 2-1: new full-speed USB device number 110 using dummy_hcd [ 601.680020][T12316] usb 6-1: USB disconnect, device number 84 [ 601.838017][T12309] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 601.854889][T12309] usb 2-1: can't read configurations, error -22 [ 602.038434][T13001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 602.047869][T13001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 602.067375][T12313] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 602.080584][T12309] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 602.115810][ T976] usb 3-1: USB disconnect, device number 98 [ 602.215926][T12316] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 602.237162][T12313] usb 1-1: Using ep0 maxpacket: 16 [ 602.244541][T12309] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 602.253417][T12313] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 602.269230][T12309] usb 2-1: can't read configurations, error -22 [ 602.276131][T12313] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 602.319444][T12313] usb 1-1: New USB device found, idVendor=1430, idProduct=474c, bcdDevice= 0.00 [ 602.329026][T12313] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.341140][T12313] usb 1-1: config 0 descriptor?? [ 602.341831][T12309] usb usb2-port1: attempt power cycle [ 602.396024][T12316] usb 6-1: device descriptor read/64, error -71 [ 602.656013][T12316] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 602.719516][T12309] usb 2-1: new full-speed USB device number 112 using dummy_hcd [ 602.762231][T12309] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 602.770957][T12309] usb 2-1: can't read configurations, error -22 [ 602.789886][T12313] usbhid 1-1:0.0: can't add hid device: -71 [ 602.795983][T12316] usb 6-1: device descriptor read/64, error -71 [ 602.819900][T12313] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 602.878126][T12313] usb 1-1: USB disconnect, device number 120 [ 602.905492][T12309] usb 2-1: new full-speed USB device number 113 using dummy_hcd [ 602.936451][T12316] usb usb6-port1: attempt power cycle [ 602.945343][T12309] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 602.953697][T12309] usb 2-1: can't read configurations, error -22 [ 602.965840][T12309] usb usb2-port1: unable to enumerate USB device [ 603.315513][T12316] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 603.350092][T12316] usb 6-1: device descriptor read/8, error -71 [ 603.595669][T12316] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 603.609626][T12313] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 603.620383][T12316] usb 6-1: device descriptor read/8, error -71 [ 603.736321][T12316] usb usb6-port1: unable to enumerate USB device [ 603.767396][T12313] usb 1-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 603.781270][T12313] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 603.799397][T12313] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 603.812603][T12313] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.854878][T12313] usb 1-1: config 0 descriptor?? [ 603.873015][T12313] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 604.911664][ T30] kauditd_printk_skb: 75 callbacks suppressed [ 604.911683][ T30] audit: type=1326 audit(1748082240.311:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13030 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 604.953681][ T30] audit: type=1326 audit(1748082240.311:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13030 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 604.990480][ T30] audit: type=1326 audit(1748082240.351:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13030 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 605.017782][ T30] audit: type=1326 audit(1748082240.351:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13030 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 605.066991][ T30] audit: type=1326 audit(1748082240.351:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13030 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 606.912195][ T5830] usb 1-1: USB disconnect, device number 121 [ 607.280904][ T30] audit: type=1326 audit(1748082242.681:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13055 comm="syz.5.1793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd6c7b8e969 code=0x7ffc0000 [ 607.363575][ T30] audit: type=1326 audit(1748082242.681:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13055 comm="syz.5.1793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd6c7b2ab39 code=0x7ffc0000 [ 607.423719][ T30] audit: type=1326 audit(1748082242.681:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13055 comm="syz.5.1793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd6c7b2ab39 code=0x7ffc0000 [ 607.495608][ T30] audit: type=1326 audit(1748082242.681:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13055 comm="syz.5.1793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd6c7b2ab39 code=0x7ffc0000 [ 607.556841][ T30] audit: type=1326 audit(1748082242.681:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13055 comm="syz.5.1793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd6c7b2ab39 code=0x7ffc0000 [ 612.444167][T13143] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1816'. [ 612.756362][ T30] kauditd_printk_skb: 274 callbacks suppressed [ 612.756382][ T30] audit: type=1326 audit(1748082248.151:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 612.854442][ T30] audit: type=1326 audit(1748082248.151:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 612.925949][ T30] audit: type=1326 audit(1748082248.151:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=173 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.003895][ T30] audit: type=1326 audit(1748082248.151:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.062123][ T30] audit: type=1326 audit(1748082248.151:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.117701][ T30] audit: type=1326 audit(1748082248.151:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.173372][ T30] audit: type=1326 audit(1748082248.151:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.217830][ T30] audit: type=1326 audit(1748082248.151:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.253512][ T30] audit: type=1326 audit(1748082248.151:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.295864][ T30] audit: type=1326 audit(1748082248.151:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13148 comm="syz.2.1822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f285258e969 code=0x7ffc0000 [ 613.404766][T13161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 613.451356][T13161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.195121][T13221] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1841'. [ 619.829358][ T5830] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 619.934020][T13262] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1860'. [ 620.029309][ T5830] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 620.047770][ T5830] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 620.071781][ T5830] usb 2-1: New USB device found, idVendor=0525, idProduct=e4a1, bcdDevice= 0.40 [ 620.085901][ T5830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.104468][ T5830] usb 2-1: Product: syz [ 620.113821][ T5830] usb 2-1: Manufacturer: syz [ 620.122926][ T5830] usb 2-1: SerialNumber: syz [ 620.364472][T13258] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 620.982305][T13258] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 621.193636][ T5830] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 621.204694][ T5830] cdc_ncm 2-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 621.223671][ T5830] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 621.450759][ T5830] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 621.485016][ T5830] usb 2-1: USB disconnect, device number 114 [ 621.493694][ T5830] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 622.909346][T13308] vlan0: entered promiscuous mode [ 622.939284][T13308] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1876'. [ 623.345800][T13313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 623.363801][T13313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 623.753856][T13322] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 623.845953][T12313] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 624.040352][T12313] usb 2-1: Using ep0 maxpacket: 16 [ 624.048651][T12313] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 624.055656][ T976] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 624.068228][T12313] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 0 [ 624.098752][T12313] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 624.116068][T12313] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.148134][T12313] usb 2-1: Product: syz [ 624.152450][T12313] usb 2-1: Manufacturer: syz [ 624.165845][T12313] usb 2-1: SerialNumber: syz [ 624.206128][T12313] usb 2-1: config 0 descriptor?? [ 624.234867][T12313] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 624.254835][T12313] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 624.332790][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.339501][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.359889][ T976] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 624.437809][ T976] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 624.565581][ T976] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.623344][ T976] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 624.704606][ T976] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 624.856728][T12313] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 625.413652][T13333] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1881'. [ 625.423169][T13333] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1881'. [ 625.484661][T12313] em28xx 2-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=131) [ 625.496007][T12313] em28xx 2-1:0.0: board has no eeprom [ 625.796135][T12313] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 625.858356][T12313] em28xx 2-1:0.0: dvb set to bulk mode. [ 625.909198][T12316] em28xx 2-1:0.0: Binding DVB extension [ 625.922387][T12313] usb 2-1: USB disconnect, device number 115 [ 626.169424][T12313] em28xx 2-1:0.0: Disconnecting em28xx [ 626.434161][T12316] em28xx 2-1:0.0: Registering input extension [ 626.464989][T13343] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 626.472268][T12313] em28xx 2-1:0.0: Closing input extension [ 626.593765][T13343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.605639][T13343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.636791][T13343] vlan2: entered promiscuous mode [ 627.036556][T12313] em28xx 2-1:0.0: Freeing device [ 627.785958][T13351] loop8: detected capacity change from 0 to 7 [ 627.798354][ T6034] Dev loop8: unable to read RDB block 7 [ 627.804057][ T6034] loop8: AHDI p3 [ 627.812188][ T6034] loop8: partition table partially beyond EOD, truncated [ 627.833819][T13351] Dev loop8: unable to read RDB block 7 [ 627.850274][T13351] loop8: AHDI p3 [ 627.863571][T13351] loop8: partition table partially beyond EOD, truncated [ 627.963345][ T6034] Dev loop8: unable to read RDB block 7 [ 627.977395][ T6034] loop8: AHDI p3 [ 627.984119][ T6034] loop8: partition table partially beyond EOD, truncated [ 628.019399][T13352] Dev loop8: unable to read RDB block 7 [ 628.025279][T13352] loop8: AHDI p3 [ 628.033420][T13352] loop8: partition table partially beyond EOD, truncated [ 628.203285][T12309] usb 1-1: USB disconnect, device number 122 [ 628.255795][T12316] usb 2-1: new full-speed USB device number 116 using dummy_hcd [ 628.413582][T13360] loop8: detected capacity change from 0 to 7 [ 628.426838][T13360] Dev loop8: unable to read RDB block 7 [ 628.432622][T13360] loop8: AHDI p1 p2 p3 [ 628.442780][T13360] loop8: partition table partially beyond EOD, truncated [ 628.459650][T13360] loop8: p1 start 1601398130 is beyond EOD, truncated [ 628.497930][T12316] usb 2-1: config 0 has an invalid interface number: 133 but max is 0 [ 628.500224][T13360] loop8: p2 start 1702059890 is beyond EOD, [ 628.510730][T12316] usb 2-1: config 0 has no interface number 0 [ 628.524057][T13360] truncated [ 628.561328][T12316] usb 2-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 628.592410][T12316] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.636038][T12316] usb 2-1: Product: syz [ 628.650638][T12316] usb 2-1: Manufacturer: syz [ 628.680066][T12316] usb 2-1: SerialNumber: syz [ 628.711611][T12316] usb 2-1: config 0 descriptor?? [ 628.969404][T12316] keyspan 2-1:0.133: Keyspan 1 port adapter converter detected [ 629.003462][T12316] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 81 [ 629.026074][T12313] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 629.143098][T12316] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 1 [ 629.182163][T12316] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 2 [ 629.243229][T12316] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 629.356305][T12313] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 629.371493][T12313] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 629.400596][T12316] usb 2-1: USB disconnect, device number 116 [ 629.425371][T12313] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 629.436115][T12316] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 629.465103][T12313] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.482070][T12316] keyspan 2-1:0.133: device disconnected [ 629.536184][T12313] usb 3-1: config 0 descriptor?? [ 629.591217][T12313] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 630.525978][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 630.525997][ T30] audit: type=1326 audit(1748082265.911:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.691304][ T30] audit: type=1326 audit(1748082266.001:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.845956][ T30] audit: type=1326 audit(1748082266.001:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.926081][ T30] audit: type=1326 audit(1748082266.001:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.949791][ T30] audit: type=1326 audit(1748082266.001:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.972839][ T30] audit: type=1326 audit(1748082266.001:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 630.997150][ T30] audit: type=1326 audit(1748082266.001:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 631.023657][ T30] audit: type=1326 audit(1748082266.001:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 631.050762][ T30] audit: type=1326 audit(1748082266.011:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 631.073880][ T30] audit: type=1326 audit(1748082266.021:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13386 comm="syz.1.1899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8f70b8e969 code=0x7ffc0000 [ 631.849943][T13406] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 632.133090][T12309] usb 3-1: USB disconnect, device number 99 [ 632.225519][T12316] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 632.561423][T12316] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 632.637127][T12316] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 632.710265][T12316] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.912506][T12316] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 632.972311][T12316] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 632.975584][T12309] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 633.341771][T12309] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 633.360185][T13415] loop8: detected capacity change from 0 to 7 [ 633.395982][T12309] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 633.396730][T13415] Dev loop8: unable to read RDB block 7 [ 633.426542][T13415] loop8: AHDI p1 p2 p3 [ 633.438927][T13415] loop8: partition table partially beyond EOD, truncated [ 633.452506][T12309] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 633.479722][T12309] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.511646][T13415] loop8: p1 start 1601398130 is beyond EOD, truncated [ 633.513794][T13412] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 633.562781][T12309] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 633.584539][T13415] loop8: p2 start 1702059890 is beyond EOD, truncated [ 633.591586][T13417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.605693][ T976] usb 6-1: new full-speed USB device number 89 using dummy_hcd [ 633.772597][T13417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.820004][T13413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.830304][T13413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.848179][ T976] usb 6-1: config 2 has an invalid interface number: 10 but max is 0 [ 633.871955][ T976] usb 6-1: config 2 has an invalid interface descriptor of length 2, skipping [ 633.891538][T13413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.901882][T13413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.997024][ T976] usb 6-1: config 2 has no interface number 0 [ 634.032612][ T976] usb 6-1: config 2 interface 10 altsetting 12 has a duplicate endpoint with address 0x7, skipping [ 634.055046][ T976] usb 6-1: config 2 interface 10 altsetting 12 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 634.069460][ T976] usb 6-1: config 2 interface 10 has no altsetting 0 [ 634.089203][ T976] usb 6-1: New USB device found, idVendor=054c, idProduct=002b, bcdDevice= 1.0c [ 634.102146][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.173032][ T976] usb 6-1: Product: syz [ 634.177664][ T976] usb 6-1: Manufacturer: syz [ 634.249190][ T976] usb 6-1: SerialNumber: syz [ 634.466289][T12309] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 634.589536][T13425] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1907'. [ 634.610331][T12316] usb 3-1: USB disconnect, device number 100 [ 634.720648][T12309] usb 2-1: config 0 has no interfaces? [ 634.737432][T12309] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 634.746807][T12309] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.891173][ T976] ums-isd200 6-1:2.10: USB Mass Storage device detected [ 634.910435][T12309] usb 2-1: Product: syz [ 634.922665][T12309] usb 2-1: Manufacturer: syz [ 634.941095][T12309] usb 2-1: SerialNumber: syz [ 635.026782][T12309] usb 2-1: config 0 descriptor?? [ 635.057551][ T976] usb 6-1: USB disconnect, device number 89 [ 635.162409][T12309] usb 1-1: USB disconnect, device number 123 [ 635.598984][T13441] ip6t_srh: unknown srh invflags 7D00 [ 636.086625][T13444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 636.103266][T13444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 636.456802][T13446] netlink: 'syz.0.1912': attribute type 11 has an invalid length. [ 636.725588][T12313] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 636.998938][T13454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.012029][T13454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 637.223200][ T976] usb 2-1: USB disconnect, device number 117 [ 637.301715][T12313] usb 1-1: Using ep0 maxpacket: 32 [ 637.340618][T12313] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 637.355725][T12313] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 637.406185][T12313] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 637.464837][T12313] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 637.608129][T12313] usb 1-1: config 0 interface 0 has no altsetting 0 [ 637.623388][T12313] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 637.680682][T12313] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 637.693435][T12313] usb 1-1: Product: syz [ 637.792842][T12313] usb 1-1: Manufacturer: syz [ 637.919007][T12313] usb 1-1: SerialNumber: syz [ 637.939632][T12313] usb 1-1: config 0 descriptor?? [ 638.003287][T12313] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 638.052821][T12313] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 638.207685][ T976] usb 1-1: USB disconnect, device number 124 [ 638.229376][ T976] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 639.311688][T13478] loop8: detected capacity change from 0 to 7 [ 639.319704][ T6034] Dev loop8: unable to read RDB block 7 [ 639.325320][ T6034] loop8: AHDI p1 p2 p3 [ 639.334048][ T6034] loop8: partition table partially beyond EOD, truncated [ 639.341800][ T6034] loop8: p1 start 1601398130 is beyond EOD, truncated [ 639.348682][ T6034] loop8: p2 start 1702059890 is beyond EOD, truncated [ 639.373806][T13478] Dev loop8: unable to read RDB block 7 [ 639.379926][T13478] loop8: AHDI p1 p2 p3 [ 639.384139][T13478] loop8: partition table partially beyond EOD, truncated [ 639.404689][T13478] loop8: p1 start 1601398130 is beyond EOD, truncated [ 639.421263][T13478] loop8: p2 start 1702059890 is beyond EOD, truncated [ 639.773564][T13486] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 640.055759][T12316] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 640.416679][T12316] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 640.457845][T12316] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 640.557302][T12316] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.759839][T12316] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 640.881441][T12316] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 640.932968][T13492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 640.954989][T13492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 640.979280][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 640.979295][ T30] audit: type=1326 audit(1748082276.371:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.048772][T13492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 641.119606][T13492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 641.202587][ T30] audit: type=1326 audit(1748082276.371:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.229224][ T30] audit: type=1326 audit(1748082276.371:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.254941][ T30] audit: type=1326 audit(1748082276.371:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f374e58d2d0 code=0x7ffc0000 [ 641.286360][ T30] audit: type=1326 audit(1748082276.371:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f374e58e56b code=0x7ffc0000 [ 641.309635][ T30] audit: type=1326 audit(1748082276.371:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f374e58e56b code=0x7ffc0000 [ 641.341593][ T30] audit: type=1326 audit(1748082276.651:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.365153][ T30] audit: type=1326 audit(1748082276.651:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.410594][T13496] syzkaller0: entered allmulticast mode [ 641.425679][T13496] syzkaller0 (unregistering): left allmulticast mode [ 641.538877][ T30] audit: type=1326 audit(1748082276.651:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.561184][ C1] vkms_vblank_simulate: vblank timer overrun [ 641.565707][T12309] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 641.581184][ T30] audit: type=1326 audit(1748082276.651:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13490 comm="syz.3.1921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f374e58e969 code=0x7ffc0000 [ 641.747135][T13504] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1925'. [ 641.786863][T12309] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 641.799958][T12309] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 641.905518][T12316] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 641.935969][T12309] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 641.950148][T12309] usb 3-1: config 220 has no interface number 2 [ 641.956599][T12309] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 641.975976][T12309] usb 3-1: config 220 interface 0 has no altsetting 0 [ 641.992972][T12309] usb 3-1: config 220 interface 76 has no altsetting 0 [ 642.004539][T12309] usb 3-1: config 220 interface 1 has no altsetting 0 [ 642.041475][T12309] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 642.050613][T12309] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.072037][T12309] usb 3-1: Product: syz [ 642.085725][T12313] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 642.103283][T12309] usb 3-1: Manufacturer: syz [ 642.103304][T12316] usb 6-1: config 0 has no interfaces? [ 642.114772][T12309] usb 3-1: SerialNumber: syz [ 642.161505][T12316] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 642.187228][T12316] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.210734][T12316] usb 6-1: Product: syz [ 642.224955][T12316] usb 6-1: Manufacturer: syz [ 642.245681][T12313] usb 1-1: Using ep0 maxpacket: 32 [ 642.262706][T12316] usb 6-1: SerialNumber: syz [ 642.273691][T12313] usb 1-1: config 0 has no interfaces? [ 642.279882][T12313] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 642.297575][T12316] usb 6-1: config 0 descriptor?? [ 642.335065][T12313] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.382447][T12313] usb 1-1: config 0 descriptor?? [ 642.474290][T12309] usb 3-1: selecting invalid altsetting 0 [ 642.491862][T12309] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 642.509586][T12309] usb 3-1: No valid video chain found. [ 642.533790][T12309] usb 3-1: selecting invalid altsetting 0 [ 642.569564][T12309] usbtest 3-1:220.1: probe with driver usbtest failed with error -22 [ 642.613620][T12309] usb 3-1: USB disconnect, device number 101 [ 643.471141][T12309] usb 2-1: USB disconnect, device number 118 [ 643.974445][T13524] ip6t_srh: unknown srh invflags 7D00 [ 644.751236][T13503] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 644.764958][T12313] usb 1-1: USB disconnect, device number 125 [ 644.807174][T12316] usb 6-1: USB disconnect, device number 90 [ 645.717548][T13547] loop7: detected capacity change from 0 to 16384 [ 645.917012][T13550] loop7: detected capacity change from 16384 to 16383 [ 646.265599][T12316] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 646.661350][T12316] usb 1-1: config 0 has no interfaces? [ 646.681475][T12316] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 646.691371][T12316] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.706318][T12316] usb 1-1: Product: syz [ 646.727461][T12316] usb 1-1: Manufacturer: syz [ 646.756065][T12316] usb 1-1: SerialNumber: syz [ 646.773836][T12316] usb 1-1: config 0 descriptor?? [ 647.946786][T13566] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 648.032164][T13568] bridge0: port 1(syz_tun) entered blocking state [ 648.039870][T13568] bridge0: port 1(syz_tun) entered disabled state [ 648.245617][T12316] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 648.416208][T12316] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 648.426614][T12316] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 648.469415][T12316] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.528261][T12316] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 648.711019][T12316] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 648.722553][ T6034] udevd[6034]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 648.939226][T12309] usb 1-1: USB disconnect, device number 126 [ 649.117146][T12322] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 649.546175][T12313] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 649.573314][T12322] usb 2-1: config 0 has no interfaces? [ 649.637655][T12322] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 649.647520][T12322] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.648125][T13598] ip6t_srh: unknown srh invflags 7D00 [ 649.661718][T12322] usb 2-1: Product: syz [ 649.675723][T12322] usb 2-1: Manufacturer: syz [ 649.687738][T12322] usb 2-1: SerialNumber: syz [ 649.695818][T12313] usb 1-1: device descriptor read/64, error -71 [ 649.921163][T12322] usb 2-1: config 0 descriptor?? [ 649.996009][T12313] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 650.158734][T12313] usb 1-1: device descriptor read/64, error -71 [ 650.279228][T12313] usb usb1-port1: attempt power cycle [ 650.625500][T12313] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 650.693884][T12313] usb 1-1: device descriptor read/8, error -71 [ 650.945809][T12313] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 650.966978][T12313] usb 1-1: device descriptor read/8, error -71 [ 651.079484][T12322] usb 3-1: USB disconnect, device number 102 [ 651.097489][T12313] usb usb1-port1: unable to enumerate USB device [ 651.505314][T13621] ip6t_srh: unknown srh invflags 7D00 [ 652.442368][T12316] usb 2-1: USB disconnect, device number 119 [ 652.883878][T13645] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1956'. [ 652.893152][T13645] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1956'. [ 653.068967][T13647] FAULT_INJECTION: forcing a failure. [ 653.068967][T13647] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 653.094233][T13647] CPU: 0 UID: 0 PID: 13647 Comm: syz.3.1961 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 653.094267][T13647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 653.094282][T13647] Call Trace: [ 653.094291][T13647] [ 653.094302][T13647] dump_stack_lvl+0x189/0x250 [ 653.094342][T13647] ? __lock_acquire+0xaac/0xd20 [ 653.094374][T13647] ? __pfx_dump_stack_lvl+0x10/0x10 [ 653.094403][T13647] ? __pfx__printk+0x10/0x10 [ 653.094425][T13647] ? __might_fault+0xb0/0x130 [ 653.094464][T13647] should_fail_ex+0x414/0x560 [ 653.094493][T13647] _copy_from_iter+0x1db/0x15a0 [ 653.094537][T13647] ? __pfx__copy_from_iter+0x10/0x10 [ 653.094568][T13647] ? is_bpf_text_address+0x26/0x2b0 [ 653.094609][T13647] tun_get_user+0x20c/0x3c20 [ 653.094661][T13647] ? aa_file_perm+0x11f/0xed0 [ 653.094687][T13647] ? __pfx_tun_get_user+0x10/0x10 [ 653.094716][T13647] ? aa_file_perm+0x11f/0xed0 [ 653.094741][T13647] ? aa_file_perm+0x3e7/0xed0 [ 653.094780][T13647] ? ref_tracker_alloc+0x318/0x460 [ 653.094807][T13647] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 653.094837][T13647] ? tun_get+0x1c/0x2f0 [ 653.094873][T13647] ? tun_get+0x1c/0x2f0 [ 653.094902][T13647] ? tun_get+0x1c/0x2f0 [ 653.094937][T13647] tun_chr_write_iter+0x113/0x200 [ 653.094971][T13647] vfs_write+0x548/0xa90 [ 653.095001][T13647] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 653.095032][T13647] ? __pfx_vfs_write+0x10/0x10 [ 653.095069][T13647] ? __fget_files+0x2a/0x420 [ 653.095111][T13647] ksys_write+0x145/0x250 [ 653.095135][T13647] ? rcu_is_watching+0x15/0xb0 [ 653.095156][T13647] ? __pfx_ksys_write+0x10/0x10 [ 653.095184][T13647] ? do_syscall_64+0xba/0x210 [ 653.095217][T13647] do_syscall_64+0xf6/0x210 [ 653.095246][T13647] ? clear_bhb_loop+0x60/0xb0 [ 653.095272][T13647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.095293][T13647] RIP: 0033:0x7f374e58e969 [ 653.095313][T13647] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 653.095340][T13647] RSP: 002b:00007f374f36b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 653.095364][T13647] RAX: ffffffffffffffda RBX: 00007f374e7b5fa0 RCX: 00007f374e58e969 [ 653.095379][T13647] RDX: 000000000000fdef RSI: 0000200000000600 RDI: 0000000000000004 [ 653.095392][T13647] RBP: 00007f374f36b090 R08: 0000000000000000 R09: 0000000000000000 [ 653.095406][T13647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.095420][T13647] R13: 0000000000000000 R14: 00007f374e7b5fa0 R15: 00007f374e8dfa28 [ 653.095451][T13647] [ 653.347242][ C0] vkms_vblank_simulate: vblank timer overrun [ 654.023121][T13655] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 654.212105][T13660] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1965'. [ 654.338014][T12309] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 654.522984][T12309] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 654.621133][T12309] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 654.724618][T12309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.746598][T13666] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1968'. [ 654.789534][T12309] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 654.957192][T12309] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 654.976454][ T6034] udevd[6034]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 655.093427][T13676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.104899][T13676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.265536][T12309] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 655.285767][T12316] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 655.418424][T12309] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 655.442553][T12309] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 655.454020][T12309] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 655.465794][T12316] usb 2-1: Using ep0 maxpacket: 16 [ 655.472613][T12309] usb 6-1: SerialNumber: syz [ 655.478556][T12316] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 655.487231][T12316] usb 2-1: can't read configurations, error -61 [ 655.506235][T12309] usb 6-1: bad CDC descriptors [ 655.625737][T12316] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 655.778047][T13682] FAULT_INJECTION: forcing a failure. [ 655.778047][T13682] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 655.794150][T12316] usb 2-1: Using ep0 maxpacket: 16 [ 655.799899][T13682] CPU: 1 UID: 0 PID: 13682 Comm: syz.3.1975 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 655.799933][T13682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 655.799946][T13682] Call Trace: [ 655.799955][T13682] [ 655.799964][T13682] dump_stack_lvl+0x189/0x250 [ 655.799998][T13682] ? __lock_acquire+0xaac/0xd20 [ 655.800029][T13682] ? __pfx_dump_stack_lvl+0x10/0x10 [ 655.800057][T13682] ? __pfx__printk+0x10/0x10 [ 655.800078][T13682] ? __might_fault+0xb0/0x130 [ 655.800115][T13682] should_fail_ex+0x414/0x560 [ 655.800142][T13682] _copy_from_iter+0x1db/0x15a0 [ 655.800181][T13682] ? __pfx__copy_from_iter+0x10/0x10 [ 655.800211][T13682] ? is_bpf_text_address+0x26/0x2b0 [ 655.800249][T13682] tun_get_user+0x4b2/0x3c20 [ 655.800298][T13682] ? aa_file_perm+0x11f/0xed0 [ 655.800325][T13682] ? __pfx_tun_get_user+0x10/0x10 [ 655.800362][T13682] ? aa_file_perm+0x11f/0xed0 [ 655.800386][T13682] ? aa_file_perm+0x3e7/0xed0 [ 655.800423][T13682] ? ref_tracker_alloc+0x318/0x460 [ 655.800450][T13682] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 655.800479][T13682] ? tun_get+0x1c/0x2f0 [ 655.800513][T13682] ? tun_get+0x1c/0x2f0 [ 655.800541][T13682] ? tun_get+0x1c/0x2f0 [ 655.800574][T13682] tun_chr_write_iter+0x113/0x200 [ 655.800607][T13682] vfs_write+0x548/0xa90 [ 655.800635][T13682] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 655.800665][T13682] ? __pfx_vfs_write+0x10/0x10 [ 655.800699][T13682] ? __fget_files+0x2a/0x420 [ 655.800735][T13682] ksys_write+0x145/0x250 [ 655.800758][T13682] ? rcu_is_watching+0x15/0xb0 [ 655.800778][T13682] ? __pfx_ksys_write+0x10/0x10 [ 655.800806][T13682] ? do_syscall_64+0xba/0x210 [ 655.800837][T13682] do_syscall_64+0xf6/0x210 [ 655.800863][T13682] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 655.800884][T13682] ? clear_bhb_loop+0x60/0xb0 [ 655.800908][T13682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.800928][T13682] RIP: 0033:0x7f374e58e969 [ 655.800947][T13682] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 655.800965][T13682] RSP: 002b:00007f374f36b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 655.800987][T13682] RAX: ffffffffffffffda RBX: 00007f374e7b5fa0 RCX: 00007f374e58e969 [ 655.801002][T13682] RDX: 000000000000fdef RSI: 0000200000000600 RDI: 0000000000000004 [ 655.801014][T13682] RBP: 00007f374f36b090 R08: 0000000000000000 R09: 0000000000000000 [ 655.801027][T13682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 655.801039][T13682] R13: 0000000000000000 R14: 00007f374e7b5fa0 R15: 00007f374e8dfa28 [ 655.801070][T13682] [ 655.803115][T12316] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 656.103915][T12316] usb 2-1: can't read configurations, error -61 [ 656.110783][T12316] usb usb2-port1: attempt power cycle [ 656.223155][T13688] loop8: detected capacity change from 0 to 7 [ 656.231743][T13688] Dev loop8: unable to read RDB block 7 [ 656.241887][T13688] loop8: AHDI p3 [ 656.253981][T13688] loop8: partition table partially beyond EOD, truncated [ 656.297142][ T6034] Dev loop8: unable to read RDB block 7 [ 656.304810][ T6034] loop8: AHDI p3 [ 656.308927][ T6034] loop8: partition table partially beyond EOD, truncated [ 656.326961][T13688] Dev loop8: unable to read RDB block 7 [ 656.343706][T13688] loop8: AHDI p3 [ 656.348070][T13688] loop8: partition table partially beyond EOD, truncated [ 656.466374][T12316] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 656.498281][T12316] usb 2-1: Using ep0 maxpacket: 16 [ 656.507347][T12316] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 656.515216][T12316] usb 2-1: can't read configurations, error -61 [ 656.565992][T12313] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 656.656204][T12316] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 656.696579][T12316] usb 2-1: Using ep0 maxpacket: 16 [ 656.709387][T12316] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 656.725312][T12316] usb 2-1: can't read configurations, error -61 [ 656.782537][T12313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 656.795013][T12316] usb usb2-port1: unable to enumerate USB device [ 656.807602][T12313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 656.820026][T12313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 10 [ 656.895315][T12313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 656.920373][T12313] usb 3-1: New USB device found, idVendor=10c4, idProduct=8acf, bcdDevice= 0.00 [ 656.958102][T12313] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.971777][ T31] INFO: task kworker/0:3:5889 blocked for more than 143 seconds. [ 656.995472][ T31] Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 [ 657.008074][T12313] usb 3-1: config 0 descriptor?? [ 657.050396][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 657.069693][ T31] task:kworker/0:3 state:D stack:20104 pid:5889 tgid:5889 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 657.095183][ T31] Workqueue: usb_hub_wq hub_event [ 657.100443][ T31] Call Trace: [ 657.104707][ T31] [ 657.113443][ T31] __schedule+0x16e2/0x4cd0 [ 657.122664][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 657.133859][ T31] ? schedule+0x165/0x360 [ 657.140164][ T31] ? __pfx___schedule+0x10/0x10 [ 657.150180][ T31] ? schedule+0x91/0x360 [ 657.156595][ T31] schedule+0x165/0x360 [ 657.163307][ T31] schedule_preempt_disabled+0x13/0x30 [ 657.173247][ T31] __mutex_lock+0x724/0xe80 [ 657.179901][ T31] ? __mutex_lock+0x51b/0xe80 [ 657.207587][ T31] ? hub_event+0x21cb/0x4a00 [ 657.221049][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 657.227854][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 657.236593][ T31] hub_event+0x21cb/0x4a00 [ 657.244996][ T31] ? __lock_acquire+0xaac/0xd20 [ 657.257437][ T31] ? do_raw_spin_lock+0x121/0x290 [ 657.263815][ T31] ? __pfx_hub_event+0x10/0x10 [ 657.275039][ T31] ? process_scheduled_works+0x9ec/0x17a0 [ 657.294204][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 657.301247][ T31] ? process_scheduled_works+0x9ec/0x17a0 [ 657.310738][ T31] ? process_scheduled_works+0x9ec/0x17a0 [ 657.319212][ T31] process_scheduled_works+0xadb/0x17a0 [ 657.351065][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 657.377183][ T31] worker_thread+0x8a0/0xda0 [ 657.383135][ T31] kthread+0x70e/0x8a0 [ 657.416967][ T31] ? __pfx_worker_thread+0x10/0x10 [ 657.422608][ T31] ? __pfx_kthread+0x10/0x10 [ 657.428729][ T31] ? __pfx_kthread+0x10/0x10 [ 657.434195][T12313] hid-u2fzero 0003:10C4:8ACF.001C: unknown main item tag 0x0 [ 657.440266][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 657.450719][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 657.457087][ T31] ? __pfx_kthread+0x10/0x10 [ 657.461960][ T31] ret_from_fork+0x4b/0x80 [ 657.466839][ T31] ? __pfx_kthread+0x10/0x10 [ 657.472827][ T31] ret_from_fork_asm+0x1a/0x30 [ 657.474922][T12313] hid-u2fzero 0003:10C4:8ACF.001C: unknown main item tag 0x0 [ 657.478038][ T31] [ 657.478147][ T31] [ 657.478147][ T31] Showing all locks held in the system: [ 657.500348][ T31] 5 locks held by kworker/0:0/9: [ 657.508329][ T31] #0: ffff8880212ec948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 657.520405][ T5830] usb 1-1: USB disconnect, device number 5 [ 657.529479][ T31] #1: ffffc900000e7c60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 657.550428][ T31] #2: ffff888028b32198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 657.555990][T12313] hid-u2fzero 0003:10C4:8ACF.001C: unknown main item tag 0x0 [ 657.580611][ T31] #3: ffff888028b36510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 657.591082][ T31] #4: ffff8880288a9968 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 657.595846][T12313] hid-u2fzero 0003:10C4:8ACF.001C: unknown main item tag 0x0 [ 657.606931][ T31] 1 lock held by khungtaskd/31: [ 657.619705][ T31] #0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 657.630881][T13690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.645206][T13690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.664445][ T31] 2 locks held by getty/5589: [ 657.674575][ T31] #0: ffff8880309af0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 657.684787][ T31] #1: ffffc90002fee2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 657.690572][T12313] hid-u2fzero 0003:10C4:8ACF.001C: unknown main item tag 0x0 [ 657.700224][ T31] 3 locks held by kworker/1:3/5830: [ 657.713632][ T31] #0: ffff8880212ec948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 657.731354][ T31] #1: ffffc900042efc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 657.744710][ T31] #2: ffff888145bd7220 (&dev->power.lock){-.-.}-{3:3}, at: rpm_idle+0x5e9/0x950 [ 657.744957][T12313] hid-u2fzero 0003:10C4:8ACF.001C: hidraw0: USB HID v0.00 Device [HID 10c4:8acf] on usb-dummy_hcd.2-1/input0 [ 657.759153][ T31] 5 locks held by kworker/0:3/5889: [ 657.783262][ T31] #0: ffff8880212ec948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 657.801734][ T31] #1: ffffc9000464fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 657.835402][ T31] #2: ffff888028cba198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 657.858629][T12313] hid-u2fzero 0003:10C4:8ACF.001C: U2F Zero LED initialised [ 657.866630][ T31] #3: ffff888028cbd510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 657.874649][T12313] hid-u2fzero 0003:10C4:8ACF.001C: U2F Zero RNG initialised [ 657.902212][T12313] usb 3-1: USB disconnect, device number 103 [ 657.914437][ T31] #4: ffff8880288a9968 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 657.945615][ T31] 5 locks held by kworker/1:8/12313: [ 657.951534][ T31] 1 lock held by fido_id/13698: [ 657.958283][ T31] #0: ffff88801aef7148 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0x14a/0x5d0 [ 657.969142][ T31] [ 657.971686][ T31] ============================================= [ 657.971686][ T31] [ 657.991079][T13698] fido_id[13698]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 658.039473][ T31] NMI backtrace for cpu 0 [ 658.039493][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 658.039515][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 658.039527][ T31] Call Trace: [ 658.039538][ T31] [ 658.039546][ T31] dump_stack_lvl+0x189/0x250 [ 658.039577][ T31] ? __wake_up_klogd+0xd9/0x110 [ 658.039621][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 658.039650][ T31] ? __pfx__printk+0x10/0x10 [ 658.039682][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 658.039706][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 658.039725][ T31] ? _printk+0xcf/0x120 [ 658.039749][ T31] ? __pfx__printk+0x10/0x10 [ 658.039772][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 658.039796][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 658.039820][ T31] watchdog+0xfee/0x1030 [ 658.039848][ T31] ? watchdog+0x1de/0x1030 [ 658.039881][ T31] kthread+0x70e/0x8a0 [ 658.039918][ T31] ? __pfx_watchdog+0x10/0x10 [ 658.039944][ T31] ? __pfx_kthread+0x10/0x10 [ 658.039969][ T31] ? __pfx_kthread+0x10/0x10 [ 658.039992][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 658.040014][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 658.040040][ T31] ? __pfx_kthread+0x10/0x10 [ 658.040063][ T31] ret_from_fork+0x4b/0x80 [ 658.040083][ T31] ? __pfx_kthread+0x10/0x10 [ 658.040107][ T31] ret_from_fork_asm+0x1a/0x30 [ 658.040142][ T31] [ 658.040186][ T31] Sending NMI from CPU 0 to CPUs 1: [ 658.187837][ C1] NMI backtrace for cpu 1 [ 658.187854][ C1] CPU: 1 UID: 0 PID: 13684 Comm: syz.5.1971 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 658.187876][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 658.187887][ C1] RIP: 0010:unwind_next_frame+0x130e/0x2390 [ 658.187916][ C1] Code: c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 3c 45 00 00 00 00 49 01 ef 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 27 49 63 07 4c 01 f8 49 8d 4f 04 4c 39 e0 48 0f 46 e9 49 [ 658.187931][ C1] RSP: 0018:ffffc90004e17378 EFLAGS: 00000a07 [ 658.187947][ C1] RAX: 0000000000000000 RBX: ffffffff8fda2118 RCX: dffffc0000000000 [ 658.187960][ C1] RDX: ffffffff8fda2100 RSI: ffffffff90789e96 RDI: ffffffff8bc1f5a0 [ 658.187973][ C1] RBP: ffffffff8fda2100 R08: 0000000000000007 R09: 0000000000000000 [ 658.187984][ C1] R10: 0000000000000000 R11: ffffffff8171ca05 R12: ffffffff87c5f14a [ 658.187996][ C1] R13: ffffffff8fda2100 R14: ffffc90004e17448 R15: ffffffff8fda210c [ 658.188013][ C1] FS: 0000000000000000(0000) GS:ffff8881261c2000(0000) knlGS:0000000000000000 [ 658.188027][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 658.188039][ C1] CR2: 00007f8f70d80178 CR3: 0000000071774000 CR4: 00000000003526f0 [ 658.188054][ C1] DR0: 0000000000000001 DR1: 0000000000000004 DR2: 0000000000040c81 [ 658.188065][ C1] DR3: 0000000000000006 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 658.188076][ C1] Call Trace: [ 658.188083][ C1] [ 658.188093][ C1] ? unwind_next_frame+0xa5/0x2390 [ 658.188115][ C1] ? vb2_core_queue_release+0x6b/0x150 [ 658.188149][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 658.188170][ C1] arch_stack_walk+0x11c/0x150 [ 658.188195][ C1] ? vb2_core_queue_release+0x6b/0x150 [ 658.188222][ C1] stack_trace_save+0x9c/0xe0 [ 658.188239][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 658.188263][ C1] save_stack+0xf7/0x1f0 [ 658.188285][ C1] ? __pfx_save_stack+0x10/0x10 [ 658.188304][ C1] ? __free_frozen_pages+0xb0e/0xcd0 [ 658.188327][ C1] ? vfree+0x1a6/0x330 [ 658.188348][ C1] ? vb2_vmalloc_put+0x68/0xb0 [ 658.188371][ C1] ? __vb2_buf_mem_free+0x119/0x2d0 [ 658.188395][ C1] ? __vb2_queue_free+0x414/0xb00 [ 658.188415][ C1] ? vb2_core_queue_release+0x6b/0x150 [ 658.188448][ C1] __reset_page_owner+0x71/0x1f0 [ 658.188470][ C1] __free_frozen_pages+0xb0e/0xcd0 [ 658.188498][ C1] vfree+0x1a6/0x330 [ 658.188521][ C1] ? __pfx_vb2_vmalloc_put+0x10/0x10 [ 658.188545][ C1] vb2_vmalloc_put+0x68/0xb0 [ 658.188569][ C1] __vb2_buf_mem_free+0x119/0x2d0 [ 658.188596][ C1] __vb2_queue_free+0x414/0xb00 [ 658.188625][ C1] vb2_core_queue_release+0x6b/0x150 [ 658.188650][ C1] v4l2_m2m_ctx_release+0x1e/0x40 [ 658.188667][ C1] vim2m_release+0xd5/0x140 [ 658.188686][ C1] v4l2_release+0x1ea/0x3b0 [ 658.188711][ C1] ? __pfx_v4l2_release+0x10/0x10 [ 658.188734][ C1] __fput+0x44c/0xa70 [ 658.188754][ C1] task_work_run+0x1d1/0x260 [ 658.188778][ C1] ? __pfx_task_work_run+0x10/0x10 [ 658.188806][ C1] do_exit+0x8d6/0x2550 [ 658.188831][ C1] ? do_raw_spin_lock+0x121/0x290 [ 658.188851][ C1] ? __pfx_do_exit+0x10/0x10 [ 658.188871][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 658.188899][ C1] do_group_exit+0x21c/0x2d0 [ 658.188920][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 658.188943][ C1] get_signal+0x125e/0x1310 [ 658.188979][ C1] arch_do_signal_or_restart+0x95/0x780 [ 658.188998][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 658.189021][ C1] ? local_irq_enable_exit_to_user+0x5/0x10 [ 658.189047][ C1] syscall_exit_to_user_mode+0x8b/0x120 [ 658.189069][ C1] do_syscall_64+0x103/0x210 [ 658.189091][ C1] ? clear_bhb_loop+0x60/0xb0 [ 658.189111][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.189127][ C1] RIP: 0033:0x7fd6c7b8e969 [ 658.189146][ C1] Code: Unable to access opcode bytes at 0x7fd6c7b8e93f. [ 658.189155][ C1] RSP: 002b:00007fd6c8a880e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 658.189172][ C1] RAX: fffffffffffffe00 RBX: 00007fd6c7db6168 RCX: 00007fd6c7b8e969 [ 658.189185][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd6c7db6168 [ 658.189196][ C1] RBP: 00007fd6c7db6160 R08: 0000000000000000 R09: 0000000000000000 [ 658.189207][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd6c7db616c [ 658.189218][ C1] R13: 0000000000000000 R14: 00007fd6c7edf940 R15: 00007fd6c7edfa28 [ 658.189237][ C1] [ 658.635980][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 658.642932][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 658.654853][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 658.664924][ T31] Call Trace: [ 658.668215][ T31] [ 658.671192][ T31] dump_stack_lvl+0x99/0x250 [ 658.675805][ T31] ? __asan_memcpy+0x40/0x70 [ 658.680402][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 658.685625][ T31] ? __pfx__printk+0x10/0x10 [ 658.690243][ T31] panic+0x2db/0x790 [ 658.694154][ T31] ? __pfx_panic+0x10/0x10 [ 658.698585][ T31] ? tick_nohz_tick_stopped+0x86/0xb0 [ 658.703967][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 658.709350][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 658.715519][ T31] watchdog+0x102d/0x1030 [ 658.719864][ T31] ? watchdog+0x1de/0x1030 [ 658.724313][ T31] kthread+0x70e/0x8a0 [ 658.728393][ T31] ? __pfx_watchdog+0x10/0x10 [ 658.733078][ T31] ? __pfx_kthread+0x10/0x10 [ 658.737678][ T31] ? __pfx_kthread+0x10/0x10 [ 658.742282][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 658.747489][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 658.752693][ T31] ? __pfx_kthread+0x10/0x10 [ 658.757292][ T31] ret_from_fork+0x4b/0x80 [ 658.761713][ T31] ? __pfx_kthread+0x10/0x10 [ 658.766314][ T31] ret_from_fork_asm+0x1a/0x30 [ 658.771120][ T31] [ 658.774455][ T31] Kernel Offset: disabled [ 658.778804][ T31] Rebooting in 86400 seconds..